secur32: Sanity check handle index before indexing table

[Juan Lang]

Inspired by bug 19564.
--Juan
-------------- next part --------------
From f3c8cb8242f0f4cef607a700687d26d4e2ec6674 Mon Sep 17 00:00:00 2001
From: Juan Lang <juan.lang at gmail.com>
Date: Tue, 4 Aug 2009 10:44:06 -0700
Subject: [PATCH 09/10] Sanity check handle index before indexing table

---
 dlls/secur32/schannel.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/dlls/secur32/schannel.c b/dlls/secur32/schannel.c
index 8f127e6..b9644e3 100644
--- a/dlls/secur32/schannel.c
+++ b/dlls/secur32/schannel.c
@@ -165,6 +165,7 @@ static void *schan_free_handle(ULONG_PTR handle_idx, enum schan_handle_type type
     void *object;
 
     if (handle_idx == SCHAN_INVALID_HANDLE) return NULL;
+    if (handle_idx >= schan_handle_count) return NULL;
     handle = &schan_handle_table[handle_idx];
     if (handle->type != type)
     {
@@ -185,6 +186,7 @@ static void *schan_get_object(ULONG_PTR handle_idx, enum schan_handle_type type)
     struct schan_handle *handle;
 
     if (handle_idx == SCHAN_INVALID_HANDLE) return NULL;
+    if (handle_idx >= schan_handle_count) return NULL;
     handle = &schan_handle_table[handle_idx];
     if (handle->type != type)
     {
-- 
1.6.3.2