Thomas Faber : usp10: Avoid buffer overrun in ReplaceInsertChars.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 37845242658a25edef059f3e1c0230d1b4b6255d
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=37845242658a25edef059f3e1c...

Author: Thomas Faber <thomas.faber(a)reactos.org>
Date:   Sun Jun 26 10:57:50 2016 +0200

usp10: Avoid buffer overrun in ReplaceInsertChars.

Signed-off-by: Thomas Faber <thomas.faber(a)reactos.org>
Signed-off-by: Aric Stewart <aric(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/usp10/shape.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/usp10/shape.c b/dlls/usp10/shape.c
index 3fdf84b..3ee412a 100644
--- a/dlls/usp10/shape.c
+++ b/dlls/usp10/shape.c
@@ -1596,7 +1596,7 @@ static void ReplaceInsertChars(HDC hdc, INT cWalk, INT* pcChars, WCHAR *pwOutCha
     cWalk=cWalk+1;
 
     /* Insert */
-    for (i = 1; replacements[i] != 0x0000 && i < 3; i++)
+    for (i = 1; i < 3 && replacements[i] != 0x0000; i++)
     {
         int j;
         for (j = *pcChars; j > cWalk; j--)