[PATCH 1/1] gdi32: Prevent out of bounds array access

[Fabian Maurer]

From: Fabian Maurer

This fixes some heap corruption observed in ReactOS

Signed-off-by: Fabian Maurer 
---
 dlls/gdi32/uniscribe/shape.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/gdi32/uniscribe/shape.c b/dlls/gdi32/uniscribe/shape.c
index 912d3e6965b..77225537fac 100644
--- a/dlls/gdi32/uniscribe/shape.c
+++ b/dlls/gdi32/uniscribe/shape.c
@@ -3159,7 +3159,7 @@ static void ShapeCharGlyphProp_Thai( HDC hdc, ScriptCache *psc, SCRIPT_ANALYSIS
     /* Do not allow justification between marks and their base */
     for (i = 0; i < cGlyphs; i++)
     {
-        if (!pGlyphProp[i].sva.fClusterStart)
+        if (!pGlyphProp[i].sva.fClusterStart && (i-dirL) >= 0)
             pGlyphProp[i-dirL].sva.uJustification = SCRIPT_JUSTIFY_NONE;
     }
 }