Author: khornicek Date: Sun Apr 6 13:09:04 2014 New Revision: 62651
URL: http://svn.reactos.org/svn/reactos?rev=62651&view=rev Log: [WIN32K] - Fix a possible out of bounds read. CID 731665
Modified: trunk/reactos/win32ss/gdi/ntgdi/freetype.c
Modified: trunk/reactos/win32ss/gdi/ntgdi/freetype.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/gdi/ntgdi/freetype.... ============================================================================== --- trunk/reactos/win32ss/gdi/ntgdi/freetype.c [iso-8859-1] (original) +++ trunk/reactos/win32ss/gdi/ntgdi/freetype.c [iso-8859-1] Sun Apr 6 13:09:04 2014 @@ -533,19 +533,19 @@ switch (Flags) { case TCI_SRCFONTSIG: - while (0 == (*Src >> Index & 0x0001) && Index < MAXTCIINDEX) + while (Index < MAXTCIINDEX && 0 == (*Src >> Index & 0x0001)) { Index++; } break; case TCI_SRCCODEPAGE: - while ( *Src != FontTci[Index].ciACP && Index < MAXTCIINDEX) + while (Index < MAXTCIINDEX && *Src != FontTci[Index].ciACP) { Index++; } break; case TCI_SRCCHARSET: - while ( *Src != FontTci[Index].ciCharset && Index < MAXTCIINDEX) + while (Index < MAXTCIINDEX && *Src != FontTci[Index].ciCharset) { Index++; }