Dmitry Timoshkov : windowscodecs: Fix the buffer size check in TIFF decoder's CopyPixels implementation.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 7ee553f4116b9688f574335bd71fb32f6e6c5f7a
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=7ee553f4116b9688f574335bd71fb32f6e6c5f7a

Author: Dmitry Timoshkov <dmitry at baikal.ru>
Date:   Mon Jan 14 14:14:53 2019 +0800

windowscodecs: Fix the buffer size check in TIFF decoder's CopyPixels implementation.

Signed-off-by: Dmitry Timoshkov <dmitry at baikal.ru>
Signed-off-by: Vincent Povirk <vincent at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/windowscodecs/tests/tiffformat.c | 2 --
 dlls/windowscodecs/tiffformat.c       | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/dlls/windowscodecs/tests/tiffformat.c b/dlls/windowscodecs/tests/tiffformat.c
index c15e498..7651ea1 100644
--- a/dlls/windowscodecs/tests/tiffformat.c
+++ b/dlls/windowscodecs/tests/tiffformat.c
@@ -598,11 +598,9 @@ static void test_tiff_24bpp(void)
             ok(hr == E_INVALIDARG, "CopyPixels(%u) should fail: %#x\n", stride, hr);
         else
         {
-todo_wine_if(stride > 3)
             ok(hr == S_OK, "CopyPixels(%u) error %#x\n", stride, hr);
 
             for (i = 0; i < sizeof(data); i++)
-todo_wine_if(stride > 3)
                 ok(data[i] == expected_data[i], "%u: expected %02x, got %02x\n", i, expected_data[i], data[i]);
         }
     }
diff --git a/dlls/windowscodecs/tiffformat.c b/dlls/windowscodecs/tiffformat.c
index 93af559..3d53b24 100644
--- a/dlls/windowscodecs/tiffformat.c
+++ b/dlls/windowscodecs/tiffformat.c
@@ -1105,7 +1105,7 @@ static HRESULT WINAPI TiffFrameDecode_CopyPixels(IWICBitmapFrameDecode *iface,
     if (cbStride < bytesperrow)
         return E_INVALIDARG;
 
-    if ((cbStride * prc->Height) > cbBufferSize)
+    if ((cbStride * (prc->Height-1)) + bytesperrow > cbBufferSize)
         return E_INVALIDARG;
 
     min_tile_x = prc->X / This->decode_info.tile_width;