From cbf9d1b0c6bca854c23044c0467a5841e75178e5 Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Wed, 3 Jun 2009 16:52:06 +0200
Subject: [PATCH] rpcrt4: Add checks for the number of methods being larger
 than what we support.

---
 dlls/rpcrt4/cproxy.c |  5 +++++
 dlls/rpcrt4/cstub.c  | 10 ++++++++++
 2 files changed, 15 insertions(+)

diff --git a/dlls/rpcrt4/cproxy.c b/dlls/rpcrt4/cproxy.c
index 64616123657..5186ea6bda8 100644
--- a/dlls/rpcrt4/cproxy.c
+++ b/dlls/rpcrt4/cproxy.c
@@ -133,6 +133,11 @@ static BOOL fill_stubless_table( IUnknownVtbl *vtbl, DWORD num )
     const void **entry = (const void **)(vtbl + 1);
     DWORD i, j;
 
+    if (num - 3 > BLOCK_SIZE * MAX_BLOCKS)
+    {
+        FIXME( "%u methods not supported\n", num );
+        return FALSE;
+    }
     for (i = 0; i < (num - 3 + BLOCK_SIZE - 1) / BLOCK_SIZE; i++)
     {
         const struct thunk *block = method_blocks[i];
diff --git a/dlls/rpcrt4/cstub.c b/dlls/rpcrt4/cstub.c
index 3e1ae8fb631..95ac1d89af2 100644
--- a/dlls/rpcrt4/cstub.c
+++ b/dlls/rpcrt4/cstub.c
@@ -201,6 +201,11 @@ static BOOL fill_delegated_stub_table(IUnknownVtbl *vtbl, DWORD num)
     const void **entry = (const void **)(vtbl + 1);
     DWORD i, j;
 
+    if (num - 3 > BLOCK_SIZE * MAX_BLOCKS)
+    {
+        FIXME( "%u methods not supported\n", num );
+        return FALSE;
+    }
     vtbl->QueryInterface = delegating_QueryInterface;
     vtbl->AddRef = delegating_AddRef;
     vtbl->Release = delegating_Release;
@@ -218,6 +223,11 @@ BOOL fill_delegated_proxy_table(IUnknownVtbl *vtbl, DWORD num)
     const void **entry = (const void **)(vtbl + 1);
     DWORD i, j;
 
+    if (num - 3 > BLOCK_SIZE * MAX_BLOCKS)
+    {
+        FIXME( "%u methods not supported\n", num );
+        return FALSE;
+    }
     vtbl->QueryInterface = IUnknown_QueryInterface_Proxy;
     vtbl->AddRef = IUnknown_AddRef_Proxy;
     vtbl->Release = IUnknown_Release_Proxy;