src/java.desktop/windows/native/libawt/windows/awt_BitmapUtil.cpp

*** 244,264 ****
  
      UINT width = bi.bmiHeader.biWidth;
      UINT height = abs(bi.bmiHeader.biHeight);
  
      BYTE * buf = (BYTE*)safe_Malloc(bi.bmiHeader.biSizeImage);
      bi.bmiHeader.biHeight = -(INT)height;
      ::GetDIBits(hdc, hBitmap, 0, height, buf,
              reinterpret_cast<BITMAPINFO*>(&bi), DIB_RGB_COLORS);
  
      /* reserving memory for the worst case */
      if (!IS_SAFE_SIZE_MUL(width / 2 + 1, height)) {
!         throw std::bad_alloc();
      }
      RGNDATA * pRgnData = (RGNDATA *) SAFE_SIZE_STRUCT_ALLOC(safe_Malloc,
              sizeof(RGNDATAHEADER),
              sizeof(RECT), (width / 2 + 1) * height);
      RGNDATAHEADER * pRgnHdr = (RGNDATAHEADER *) pRgnData;
      pRgnHdr->dwSize = sizeof(RGNDATAHEADER);
      pRgnHdr->iType = RDH_RECTANGLES;
      pRgnHdr->nRgnSize = 0;
      pRgnHdr->rcBound.top = 0;
--- 244,275 ----
  
      UINT width = bi.bmiHeader.biWidth;
      UINT height = abs(bi.bmiHeader.biHeight);
  
      BYTE * buf = (BYTE*)safe_Malloc(bi.bmiHeader.biSizeImage);
+     if (!buf) {
+         ::DeleteDC(hdc);
+         return NULL;
+     }
      bi.bmiHeader.biHeight = -(INT)height;
      ::GetDIBits(hdc, hBitmap, 0, height, buf,
              reinterpret_cast<BITMAPINFO*>(&bi), DIB_RGB_COLORS);
  
      /* reserving memory for the worst case */
      if (!IS_SAFE_SIZE_MUL(width / 2 + 1, height)) {
!         ::DeleteDC(hdc);
!         free(buf);
!         return NULL;
      }
      RGNDATA * pRgnData = (RGNDATA *) SAFE_SIZE_STRUCT_ALLOC(safe_Malloc,
              sizeof(RGNDATAHEADER),
              sizeof(RECT), (width / 2 + 1) * height);
+     if (!pRgnData) {
+         ::DeleteDC(hdc);
+         free(buf);
+         return NULL;
+     }
      RGNDATAHEADER * pRgnHdr = (RGNDATAHEADER *) pRgnData;
      pRgnHdr->dwSize = sizeof(RGNDATAHEADER);
      pRgnHdr->iType = RDH_RECTANGLES;
      pRgnHdr->nRgnSize = 0;
      pRgnHdr->rcBound.top = 0;