commit dd0a7078e0acd55f9cc5ac0afbf6342af8a53ae4
author Nikolay Sivov <bunglehead@gmail.com> Mon Oct 19 23:40:28 2009 +0400
committer Alexandre Julliard <julliard@winehq.org> Tue Oct 20 14:09:25 2009 +0200
tree 300dd85d6d4f78113240973d8df6745e2cc6bd4c
parent 975a93de6813706d71bdde017092dc7522afd8e9

gdi32: Prevent possible buffer overrun.

dlls/gdi32/font.c

diff --git a/dlls/gdi32/font.c b/dlls/gdi32/font.c
index c81a9c82..ed64166 100644
--- a/dlls/gdi32/font.c
+++ b/dlls/gdi32/font.c
@@ -2596,13 +2596,13 @@
     int index = 0;
     switch (flags) {
     case TCI_SRCFONTSIG:
-	while (!(*lpSrc>>index & 0x0001) && index<MAXTCIINDEX) index++;
+      while (index < MAXTCIINDEX && !(*lpSrc>>index & 0x0001)) index++;
       break;
     case TCI_SRCCODEPAGE:
-      while (PtrToUlong(lpSrc) != FONT_tci[index].ciACP && index < MAXTCIINDEX) index++;
+      while (index < MAXTCIINDEX && PtrToUlong(lpSrc) != FONT_tci[index].ciACP) index++;
       break;
     case TCI_SRCCHARSET:
-      while (PtrToUlong(lpSrc) != FONT_tci[index].ciCharset && index < MAXTCIINDEX) index++;
+      while (index < MAXTCIINDEX && PtrToUlong(lpSrc) != FONT_tci[index].ciCharset) index++;
       break;
     default:
       return FALSE;