Jacek Caban : conhost: Improve bound checking in fill_output.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f3b8ccb2f79c9b4801493898a63a2520bc43afd4
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=f3b8ccb2f79c9b4801493898a63a2520bc43afd4

Author: Jacek Caban <jacek at codeweavers.com>
Date:   Thu Sep 24 17:26:51 2020 +0200

conhost: Improve bound checking in fill_output.

Inspired by Pengpeng Dong's patch.

Signed-off-by: Jacek Caban <jacek at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 programs/conhost/conhost.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/programs/conhost/conhost.c b/programs/conhost/conhost.c
index ed52838528..61346a3817 100644
--- a/programs/conhost/conhost.c
+++ b/programs/conhost/conhost.c
@@ -2168,9 +2168,9 @@ static NTSTATUS fill_output( struct screen_buffer *screen_buffer, const struct c
 
     TRACE( "(%u %u) mode %u\n", params->x, params->y, params->mode );
 
-    dest = screen_buffer->data + params->y * screen_buffer->width + params->x;
-
     if (params->y >= screen_buffer->height) return STATUS_SUCCESS;
+    dest = screen_buffer->data + min( params->y * screen_buffer->width + params->x,
+                                      screen_buffer->height * screen_buffer->width );
 
     if (params->wrap)
         end = screen_buffer->data + screen_buffer->height * screen_buffer->width;