From 0ab46cd5e98e4d588e16425d55165e9c4475190b Mon Sep 17 00:00:00 2001 From: Huw Davies Date: Thu, 24 Nov 2011 09:26:45 +0000 Subject: [PATCH] gdi32: Avoid reading past the end of the indices array. Spotted by Marcus Meissner. --- dlls/gdi32/dibdrv/graphics.c | 3 ++- dlls/gdi32/font.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/dlls/gdi32/dibdrv/graphics.c b/dlls/gdi32/dibdrv/graphics.c index 590a8167018..d0c0afe1fe8 100644 --- a/dlls/gdi32/dibdrv/graphics.c +++ b/dlls/gdi32/dibdrv/graphics.c @@ -192,8 +192,9 @@ static DWORD get_glyph_bitmap( HDC hdc, UINT index, UINT aa_flags, GLYPHMETRICS indices[0] = index; - for (i = 0; i < sizeof(indices) / sizeof(indices[0]); index = indices[++i]) + for (i = 0; i < sizeof(indices) / sizeof(indices[0]); i++) { + index = indices[i]; ret = GetGlyphOutlineW( hdc, index, ggo_flags, metrics, 0, NULL, &identity ); if (ret != GDI_ERROR) break; } diff --git a/dlls/gdi32/font.c b/dlls/gdi32/font.c index 0f01a928f6f..5b7d50060be 100644 --- a/dlls/gdi32/font.c +++ b/dlls/gdi32/font.c @@ -1640,8 +1640,9 @@ static DWORD get_glyph_bitmap( HDC hdc, UINT index, UINT aa_flags, indices[0] = index; - for (i = 0; i < sizeof(indices) / sizeof(indices[0]); index = indices[++i]) + for (i = 0; i < sizeof(indices) / sizeof(indices[0]); i++) { + index = indices[i]; ret = GetGlyphOutlineW( hdc, index, ggo_flags, metrics, 0, NULL, &identity ); if (ret != GDI_ERROR) break; }