Thomas Faller : usp10: Fix invalid read.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f1334dbb8d1d6f3678590d38124f1c265bab385a
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=f1334dbb8d1d6f3678590d38124f1c265bab385a

Author: Thomas Faller <tfaller1 at gmx.de>
Date:   Thu Sep  3 11:50:36 2015 +0200

usp10: Fix invalid read.

---

 dlls/usp10/usp10.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/usp10/usp10.c b/dlls/usp10/usp10.c
index fa4dc79..f3fb369 100644
--- a/dlls/usp10/usp10.c
+++ b/dlls/usp10/usp10.c
@@ -1477,7 +1477,8 @@ static HRESULT _ItemizeInternal(const WCHAR *pwcInChars, int cInChars,
         }
     }
 
-    while ((!levels || (levels && levels[cnt+1] == levels[0])) && (pwcInChars[cnt] == Numeric_space) && cnt < cInChars)
+    while ((!levels || (levels && cnt+1 < cInChars && levels[cnt+1] == levels[0]))
+            && (cnt < cInChars && pwcInChars[cnt] == Numeric_space))
         cnt++;
 
     if (cnt == cInChars) /* All Spaces */