From 5eaf84d39b82f26b280fbd6e82d93c0e27633a73 Mon Sep 17 00:00:00 2001
From: Nikolay Sivov <bunglehead@gmail.com>
Date: Tue, 13 May 2008 02:04:51 +0400
Subject: [PATCH] gdiplus: Check count argument in GdipTransformMatrixPoints.

---
 dlls/gdiplus/matrix.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dlls/gdiplus/matrix.c b/dlls/gdiplus/matrix.c
index a8617db85a2..cf8b44be5bd 100644
--- a/dlls/gdiplus/matrix.c
+++ b/dlls/gdiplus/matrix.c
@@ -244,7 +244,7 @@ GpStatus WINGDIPAPI GdipTransformMatrixPoints(GpMatrix *matrix, GpPointF *pts,
     REAL x, y;
     INT i;
 
-    if(!matrix || !pts)
+    if(!matrix || !pts || count <= 0)
         return InvalidParameter;
 
     for(i = 0; i < count; i++)
@@ -265,6 +265,9 @@ GpStatus WINGDIPAPI GdipTransformMatrixPointsI(GpMatrix *matrix, GpPoint *pts, I
     GpStatus ret;
     INT i;
 
+    if(count <= 0)
+        return InvalidParameter;
+
     ptsF = GdipAlloc(sizeof(GpPointF) * count);
     if(!ptsF)
         return OutOfMemory;