Bug 1811852: Clear default DEVMODEW storage on failure, so that we tr…

…y again next time. r=emilio Differential Revision: https://phabricator.services.mozilla.com/D168110
mozilla · Feb 1, 2023 · 5e2a87e · 5e2a87e
1 parent bf3f183
commit 5e2a87e
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 4 deletions.
diff --git a/widget/windows/nsPrintSettingsWin.cpp b/widget/windows/nsPrintSettingsWin.cpp
@@ -179,9 +179,16 @@ void nsPrintSettingsWin::InitWithInitializer(
     return;
   }
 
+  auto* devmode =
+      reinterpret_cast<const DEVMODEW*>(aSettings.mDevmodeWStorage.Elements());
+  if (devmode->dmSize != sizeof(DEVMODEW) ||
+      devmode->dmSize + devmode->dmDriverExtra >
+          aSettings.mDevmodeWStorage.Length()) {
+    return;
+  }
+
   // SetDevMode copies the DEVMODE.
-  SetDevMode(const_cast<DEVMODEW*>(reinterpret_cast<const DEVMODEW*>(
-      aSettings.mDevmodeWStorage.Elements())));
+  SetDevMode(const_cast<DEVMODEW*>(devmode));
 
   if (mDevMode->dmFields & DM_SCALE) {
     // Since we do the scaling, grab the DEVMODE value and reset it back to 100.

diff --git a/widget/windows/nsPrinterWin.cpp b/widget/windows/nsPrinterWin.cpp
@@ -324,13 +324,22 @@ nsTArray<uint8_t> nsPrinterWin::CopyDefaultDevmodeW() const {
     // Allocate extra space in case of bad drivers that return a too-small
     // result from DocumentProperties.
     // (See https://bugzilla.mozilla.org/show_bug.cgi?id=1664530#c5)
-    devmodeStorageWLock->SetLength(bytesNeeded * 2);
+    if (!devmodeStorageWLock->SetLength(bytesNeeded * 2, fallible)) {
+      return devmodeStorageW;
+    }
+
+    memset(devmodeStorageWLock->Elements(), 0, devmodeStorageWLock->Length());
     auto* devmode =
         reinterpret_cast<DEVMODEW*>(devmodeStorageWLock->Elements());
     LONG ret = ::DocumentPropertiesW(nullptr, autoPrinter.get(), mName.get(),
                                      devmode, nullptr, DM_OUT_BUFFER);
     MOZ_ASSERT(ret == IDOK, "DocumentPropertiesW failed");
-    if (ret != IDOK) {
+    // Make sure that the lengths in the DEVMODEW make sense.
+    if (ret != IDOK || devmode->dmSize != sizeof(DEVMODEW) ||
+        devmode->dmSize + devmode->dmDriverExtra >
+            devmodeStorageWLock->Length()) {
+      // Clear mDefaultDevmodeWStorage to make sure we try again next time.
+      devmodeStorageWLock->Clear();
       return devmodeStorageW;
     }
   }