Indrek Altpere : winemenubuilder: Fix crash on invalid icon entries.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: c205e6800a63a5df9960d8484a2e67687d53bc50
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=c205e6800a63a5df9960d8484a...

Author: Indrek Altpere 
Date:   Thu Aug 28 19:05:19 2014 +0300

winemenubuilder: Fix crash on invalid icon entries.

---

programs/winemenubuilder/winemenubuilder.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/programs/winemenubuilder/winemenubuilder.c b/programs/winemenubuilder/winemenubuilder.c
index b617510..fba3664 100644
--- a/programs/winemenubuilder/winemenubuilder.c
+++ b/programs/winemenubuilder/winemenubuilder.c
@@ -612,6 +612,7 @@ static int populate_module_icons(HMODULE hModule, GRPICONDIR *grpIconDir, ICONDI
             if ((hResData = LoadResource(hModule, hResInfo)))
             {
                 BITMAPINFO *pIcon;
+                DWORD size = min( grpIconDir->idEntries[i].dwBytesInRes, ((IMAGE_RESOURCE_DATA_ENTRY *)hResInfo)->Size );
                 if ((pIcon = LockResource(hResData)))
                 {
                     iconDirEntries[validEntries].bWidth = grpIconDir->idEntries[i].bWidth;
@@ -620,11 +621,11 @@ static int populate_module_icons(HMODULE hModule, GRPICONDIR *grpIconDir, ICONDI
                     iconDirEntries[validEntries].bReserved = grpIconDir->idEntries[i].bReserved;
                     iconDirEntries[validEntries].wPlanes = grpIconDir->idEntries[i].wPlanes;
                     iconDirEntries[validEntries].wBitCount = grpIconDir->idEntries[i].wBitCount;
-                    iconDirEntries[validEntries].dwBytesInRes = grpIconDir->idEntries[i].dwBytesInRes;
+                    iconDirEntries[validEntries].dwBytesInRes = size;
                     iconDirEntries[validEntries].dwImageOffset = *iconOffset;
                     validEntries++;
-                    memcpy(&icons[*iconOffset], pIcon, grpIconDir->idEntries[i].dwBytesInRes);
-                    *iconOffset += grpIconDir->idEntries[i].dwBytesInRes;
+                    memcpy(&icons[*iconOffset], pIcon, size);
+                    *iconOffset += size;
                 }
                 FreeResource(hResData);
             }