From 12d3905427796fd65f21673b77381442339ca00f Mon Sep 17 00:00:00 2001
From: Dmitry Timoshkov <dmitry@codeweavers.com>
Date: Thu, 19 Jul 2007 14:56:18 +0900
Subject: [PATCH] rpcrt4: Fix the buffer bounds check.

---
 dlls/rpcrt4/ndr_marshall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c
index 26a55b191f9..b1b8fa341ec 100644
--- a/dlls/rpcrt4/ndr_marshall.c
+++ b/dlls/rpcrt4/ndr_marshall.c
@@ -759,7 +759,7 @@ unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg
 
   /* verify the buffer is safe to access */
   if ((pStubMsg->Buffer + bufsize < pStubMsg->Buffer) ||
-      (pStubMsg->Buffer + bufsize < pStubMsg->BufferEnd))
+      (pStubMsg->Buffer + bufsize > pStubMsg->BufferEnd))
   {
     ERR("bufsize 0x%x exceeded buffer end %p of buffer %p\n", bufsize,
         pStubMsg->BufferEnd, pStubMsg->Buffer);