Avoid crash in DocumentProperties

printing/backend/win_helper.cc

Index: printing/backend/win_helper.cc
diff --git a/printing/backend/win_helper.cc b/printing/backend/win_helper.cc
index 3527aeece5a455f0f63e92816532021bd4609d0f..04990a9af153aeaaa55e462248cccdb8292f6b6a 100644
--- a/printing/backend/win_helper.cc
+++ b/printing/backend/win_helper.cc
@@ -471,12 +471,7 @@ std::unique_ptr<DEVMODE, base::FreeDeleter> CreateDevModeWithColor(
   return ticket;
 }
 
-bool IsPrinterRPCSOnly(HANDLE printer) {
-  PrinterInfo5 info_5;
-  if (!info_5.Init(printer))
-    return false;
-  const wchar_t* name = info_5.get()->pPrinterName;
-  const wchar_t* port = info_5.get()->pPortName;
+bool IsPrinterRPCSOnly(const wchar_t* name, const wchar_t* port) {
   int num_languages =
       DeviceCapabilities(name, port, DC_PERSONALITY, NULL, NULL);
   if (num_languages != 1)
@@ -487,12 +482,16 @@ bool IsPrinterRPCSOnly(HANDLE printer) {
   return wcscmp(buf.data(), kRPCSLanguage) == 0;
 }
 
+bool PrinterHasValidPaperSize(const wchar_t* name, const wchar_t* port) {
+  return DeviceCapabilities(name, port, DC_PAPERSIZE, nullptr, nullptr) > 0;
+}
+
 std::unique_ptr<DEVMODE, base::FreeDeleter> CreateDevMode(HANDLE printer,
                                                           DEVMODE* in) {
   LONG buffer_size = DocumentProperties(
       NULL, printer, const_cast<wchar_t*>(L""), NULL, NULL, 0);
   if (buffer_size < static_cast<int>(sizeof(DEVMODE)))
-    return std::unique_ptr<DEVMODE, base::FreeDeleter>();
+    return nullptr;
 
   // Some drivers request buffers with size smaller than dmSize + dmDriverExtra.
   // crbug.com/421402
@@ -502,17 +501,27 @@ std::unique_ptr<DEVMODE, base::FreeDeleter> CreateDevMode(HANDLE printer,
       reinterpret_cast<DEVMODE*>(calloc(buffer_size, 1)));
   DWORD flags = (in ? (DM_IN_BUFFER) : 0) | DM_OUT_BUFFER;
 
+  PrinterInfo5 info_5;
+  if (!info_5.Init(printer))
+    return nullptr;
+  const wchar_t* name = info_5.get()->pPrinterName;
+  const wchar_t* port = info_5.get()->pPortName;
+
   // Check for RPCS drivers on Windows 8+ as DocumentProperties will crash if
-  // called on one of these printers. See crbug.com/679160
-  if (base::win::GetVersion() >= base::win::VERSION_WIN8 &&
-      IsPrinterRPCSOnly(printer)) {
-    return std::unique_ptr<DEVMODE, base::FreeDeleter>();
+  // called on one of these printers. See crbug.com/679160.
+  // Also check that valid paper sizes exist; some old drivers return no paper
+  // sizes and crash in DocumentProperties if used with Win10. See
+  // crbug.com/724595
+  if ((base::win::GetVersion() >= base::win::VERSION_WIN8 &&
+       IsPrinterRPCSOnly(name, port)) ||
+      !PrinterHasValidPaperSize(name, port)) {
+    return nullptr;
   }
 
   if (DocumentProperties(
           NULL, printer, const_cast<wchar_t*>(L""), out.get(), in, flags) !=
       IDOK) {
-    return std::unique_ptr<DEVMODE, base::FreeDeleter>();
+    return nullptr;
   }
   int size = out->dmSize;
   int extra_size = out->dmDriverExtra;