Matteo Bruni : user32: Don't go past the end of the animated cursor data.
Alexandre Julliard
julliard at winehq.org
Tue Oct 1 15:50:30 CDT 2019
Module: wine
Branch: master
Commit: aaecc404642877074550ff1c156c32bc9888da74
URL: https://source.winehq.org/git/wine.git/?a=commit;h=aaecc404642877074550ff1c156c32bc9888da74
Author: Matteo Bruni <mbruni at codeweavers.com>
Date: Mon Sep 30 23:11:14 2019 +0200
user32: Don't go past the end of the animated cursor data.
Signed-off-by: Matteo Bruni <mbruni at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/user32/cursoricon.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/dlls/user32/cursoricon.c b/dlls/user32/cursoricon.c
index 3214746664..9c61d7ff30 100644
--- a/dlls/user32/cursoricon.c
+++ b/dlls/user32/cursoricon.c
@@ -1451,6 +1451,8 @@ static void riff_find_chunk( DWORD chunk_id, DWORD chunk_type, const riff_chunk_
}
ptr += sizeof(DWORD);
+ if (ptr >= end)
+ break;
ptr += (*(const DWORD *)ptr + 1) & ~1;
ptr += sizeof(DWORD);
}
More information about the wine-cvs
mailing list