Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(108)

Unified Diff: printing/backend/win_helper.cc

Issue 644463002: Zeroes buffer for DocumentProperti (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Wed Oct 8 13:17:15 PDT 2014 Created 6 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: printing/backend/win_helper.cc
diff --git a/printing/backend/win_helper.cc b/printing/backend/win_helper.cc
index bb6b69e7424ad5646c7e82c2506ab5e76497b3d3..8996b344be682d794ab36b69a1a48d3335671fab 100644
--- a/printing/backend/win_helper.cc
+++ b/printing/backend/win_helper.cc
@@ -477,14 +477,16 @@ scoped_ptr<DEVMODE, base::FreeDeleter> CreateDevMode(HANDLE printer,
if (buffer_size < static_cast<int>(sizeof(DEVMODE)))
return scoped_ptr<DEVMODE, base::FreeDeleter>();
scoped_ptr<DEVMODE, base::FreeDeleter> out(
- reinterpret_cast<DEVMODE*>(malloc(buffer_size)));
+ reinterpret_cast<DEVMODE*>(calloc(buffer_size, 1)));
DWORD flags = (in ? (DM_IN_BUFFER) : 0) | DM_OUT_BUFFER;
if (DocumentProperties(
NULL, printer, const_cast<wchar_t*>(L""), out.get(), in, flags) !=
IDOK) {
return scoped_ptr<DEVMODE, base::FreeDeleter>();
}
- CHECK_GE(buffer_size, out.get()->dmSize + out.get()->dmDriverExtra);
+ int size = out->dmSize;
+ int extra_size = out->dmDriverExtra;
+ CHECK_GE(buffer_size, size + extra_size);
return out.Pass();
}
@@ -504,7 +506,7 @@ scoped_ptr<DEVMODE, base::FreeDeleter> PromptDevMode(
if (buffer_size < static_cast<int>(sizeof(DEVMODE)))
return scoped_ptr<DEVMODE, base::FreeDeleter>();
scoped_ptr<DEVMODE, base::FreeDeleter> out(
- reinterpret_cast<DEVMODE*>(malloc(buffer_size)));
+ reinterpret_cast<DEVMODE*>(calloc(buffer_size, 1)));
DWORD flags = (in ? (DM_IN_BUFFER) : 0) | DM_OUT_BUFFER | DM_IN_PROMPT;
LONG result = DocumentProperties(window,
printer,
@@ -516,7 +518,9 @@ scoped_ptr<DEVMODE, base::FreeDeleter> PromptDevMode(
*canceled = (result == IDCANCEL);
if (result != IDOK)
return scoped_ptr<DEVMODE, base::FreeDeleter>();
- CHECK_GE(buffer_size, out.get()->dmSize + out.get()->dmDriverExtra);
+ int size = out->dmSize;
+ int extra_size = out->dmDriverExtra;
+ CHECK_GE(buffer_size, size + extra_size);
return out.Pass();
}
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698