user32: Don't go past the end of the animated cursor data.

Signed-off-by: Matteo Bruni <mbruni@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

user32: Don't go past the end of the animated cursor data.
aaecc404 · Matteo Bruni · Alexandre Julliard · a172aead · aaecc404
Commit aaecc404 authored Sep 30, 2019 by Matteo Bruni Committed by Alexandre Julliard Oct 01, 2019
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

cursoricon.c dlls/user32/cursoricon.c +2 -0

No files found.
--- a/dlls/user32/cursoricon.c
+++ b/dlls/user32/cursoricon.c
@@ -1451,6 +1451,8 @@ static void riff_find_chunk( DWORD chunk_id, DWORD chunk_type, const riff_chunk_
        }

        ptr += sizeof(DWORD);
+        if (ptr >= end)
+            break;
        ptr += (*(const DWORD *)ptr + 1) & ~1;
        ptr += sizeof(DWORD);
    }