From: Thomas Faller Subject: [PATCH] usp10: Fix invalid read Message-Id: <55E817EC.9030000@gmx.de> Date: Thu, 3 Sep 2015 11:50:36 +0200 Fix for https://bugs.winehq.org/show_bug.cgi?id=36589 --- dlls/usp10/usp10.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dlls/usp10/usp10.c b/dlls/usp10/usp10.c index fa4dc79..334b52c 100644 --- a/dlls/usp10/usp10.c +++ b/dlls/usp10/usp10.c @@ -1477,7 +1477,8 @@ static HRESULT _ItemizeInternal(const WCHAR *pwcInChars, int cInChars, } } - while ((!levels || (levels && levels[cnt+1] == levels[0])) && (pwcInChars[cnt] == Numeric_space) && cnt < cInChars) + while ((!levels || (levels && cnt+1 < cInChars && levels[cnt+1] == levels[0])) + && (cnt < cInChars && pwcInChars[cnt] == Numeric_space)) cnt++; if (cnt == cInChars) /* All Spaces */