user32: Don't go past the end of the animated cursor data.

Signed-off-by: Matteo Bruni <mbruni@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>

dlls/user32/cursoricon.c

@@ -1451,6 +1451,8 @@ static void riff_find_chunk( DWORD chunk_id, DWORD chunk_type, const riff_chunk_
         }
 
         ptr += sizeof(DWORD);
+        if (ptr >= end)
+            break;
         ptr += (*(const DWORD *)ptr + 1) & ~1;
         ptr += sizeof(DWORD);
     }