Aric Stewart : usp10: Correct some reading buffer overruns when parsing indic syllables.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f0c85ff83d1f014dd9efc5b4af3fa8dc0ca3a7bc
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=f0c85ff83d1f014dd9efc5b4af...

Author: Aric Stewart 
Date:   Wed Oct 19 13:11:19 2011 -0500

usp10: Correct some reading buffer overruns when parsing indic syllables.

Found with help from Dan Kegel and Valgrind.

---

dlls/usp10/indic.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/usp10/indic.c b/dlls/usp10/indic.c
index a25ceec..f8e5b5e 100644
--- a/dlls/usp10/indic.c
+++ b/dlls/usp10/indic.c
@@ -86,7 +86,7 @@ static INT consonant_header(LPCWSTR input, INT cChar, INT start, INT next,
     next++;
     if ((next < cChar) && lex(input[next]) == lex_Nukta)
             next++;
-    if (lex(input[next])==lex_Halant)
+    if ((next < cChar) && lex(input[next])==lex_Halant)
     {
         next++;
         if((next < cChar) && is_joiner( lex(input[next]) ))
@@ -94,7 +94,7 @@ static INT consonant_header(LPCWSTR input, INT cChar, INT start, INT next,
         if ((next < cChar) && is_consonant( lex(input[next]) ))
             return next;
     }
-    else if (is_joiner( lex(input[next]) ) && lex(input[next+1])==lex_Halant)
+    else if ((next < cChar) && is_joiner( lex(input[next]) ) && lex(input[next+1])==lex_Halant)
     {
         next+=2;
         if ((next < cChar) && is_consonant( lex(input[next]) ))
@@ -163,7 +163,7 @@ static INT parse_vowel_syllable(LPCWSTR input, INT cChar, INT start,
     else if ((next < cChar) && lex(input[next])==lex_ZWJ && is_consonant( lex(input[next+1]) ))
         next+=2;

-    if (is_matra( lex(input[next]) ))
+    if ((next < cChar) && is_matra( lex(input[next]) ))
     {
         while((next < cChar) && is_matra( lex(input[next]) ))
             next++;