Double buffer size to avoid crashes with some drives.

printing/backend/win_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "printing/backend/win_helper.h"
 
 #include <algorithm>
 
 #include "base/file_version_info.h"
 #include "base/files/file_path.h"
@@ skipping 454 matching lines @@
 
   return ticket.Pass();
 }
 
 scoped_ptr<DEVMODE, base::FreeDeleter> CreateDevMode(HANDLE printer,
                                                      DEVMODE* in) {
   LONG buffer_size = DocumentProperties(
       NULL, printer, const_cast<wchar_t*>(L""), NULL, NULL, 0);
   if (buffer_size < static_cast<int>(sizeof(DEVMODE)))
     return scoped_ptr<DEVMODE, base::FreeDeleter>();
+
+  // Some drivers request buffers with size smaller than dmSize + dmDriverExtra.
+  // crbug.com/421402
+  buffer_size *= 2;
+
   scoped_ptr<DEVMODE, base::FreeDeleter> out(
       reinterpret_cast<DEVMODE*>(calloc(buffer_size, 1)));
   DWORD flags = (in ? (DM_IN_BUFFER) : 0) | DM_OUT_BUFFER;
   if (DocumentProperties(
           NULL, printer, const_cast<wchar_t*>(L""), out.get(), in, flags) !=
       IDOK) {
     return scoped_ptr<DEVMODE, base::FreeDeleter>();
   }
   int size = out->dmSize;
   int extra_size = out->dmDriverExtra;
   CHECK_GE(buffer_size, size + extra_size);
   return out.Pass();
 }
 
 scoped_ptr<DEVMODE, base::FreeDeleter> PromptDevMode(
     HANDLE printer,
     const base::string16& printer_name,
     DEVMODE* in,
     HWND window,
     bool* canceled) {
   LONG buffer_size =
       DocumentProperties(window,
                          printer,
                          const_cast<wchar_t*>(printer_name.c_str()),
                          NULL,
                          NULL,
                          0);
   if (buffer_size < static_cast<int>(sizeof(DEVMODE)))
     return scoped_ptr<DEVMODE, base::FreeDeleter>();
+
+  // Some drivers request buffers with size smaller than dmSize + dmDriverExtra.
+  // crbug.com/421402
+  buffer_size *= 2;
+
   scoped_ptr<DEVMODE, base::FreeDeleter> out(
       reinterpret_cast<DEVMODE*>(calloc(buffer_size, 1)));
   DWORD flags = (in ? (DM_IN_BUFFER) : 0) | DM_OUT_BUFFER | DM_IN_PROMPT;
   LONG result = DocumentProperties(window,
                                    printer,
                                    const_cast<wchar_t*>(printer_name.c_str()),
                                    out.get(),
                                    in,
                                    flags);
   if (canceled)
     *canceled = (result == IDCANCEL);
   if (result != IDOK)
     return scoped_ptr<DEVMODE, base::FreeDeleter>();
   int size = out->dmSize;
   int extra_size = out->dmDriverExtra;
   CHECK_GE(buffer_size, size + extra_size);
   return out.Pass();
 }
 
 }  // namespace printing