From de3486dd1c3318f318d107afe97f7a7efbd288ed Mon Sep 17 00:00:00 2001
From: Francois Jacques <francoisj@macadamian.com>
Date: Thu, 21 Dec 2000 20:18:18 +0000
Subject: [PATCH] Updated SafeArrayGetUBound and SafeArrayGetLBound with more
 sanity checks: an array has at least one dimension. Updated validCoordinates,
 where SafeArrayGetLBound was called on dimension 0.

---
 dlls/oleaut32/safearray.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dlls/oleaut32/safearray.c b/dlls/oleaut32/safearray.c
index ff0b6e2c908..7a8527d8991 100644
--- a/dlls/oleaut32/safearray.c
+++ b/dlls/oleaut32/safearray.c
@@ -373,6 +373,9 @@ HRESULT WINAPI SafeArrayGetUBound(
   if(nDim > psa->cDims) 
     return DISP_E_BADINDEX;
 
+  if(0 == nDim)
+    return DISP_E_BADINDEX;
+
   *plUbound = psa->rgsabound[nDim-1].lLbound + 
               psa->rgsabound[nDim-1].cElements - 1;
 
@@ -394,6 +397,9 @@ HRESULT WINAPI SafeArrayGetLBound(
   if(nDim > psa->cDims) 
     return DISP_E_BADINDEX;
 
+  if(0 == nDim)
+    return DISP_E_BADINDEX;
+  
   *plLbound = psa->rgsabound[nDim-1].lLbound;
   return S_OK;
 }
@@ -951,9 +957,9 @@ static BOOL validCoordinate(
   HRESULT hRes;
 
   for(; iter<psa->cDims; iter++) {
-    if((hRes = SafeArrayGetLBound(psa, iter, &lLBound)) != S_OK)
+    if((hRes = SafeArrayGetLBound(psa, (iter+1), &lLBound)) != S_OK)
       return FALSE;
-    if((hRes = SafeArrayGetUBound(psa, iter, &lUBound)) != S_OK)
+    if((hRes = SafeArrayGetUBound(psa, (iter+1), &lUBound)) != S_OK)
       return FALSE;
  
     if(lLBound == lUBound)