From d141ce54b6d61baf01f35b191bdf6c9da3765fd4 Mon Sep 17 00:00:00 2001
From: Kamil Hornicek <kamil.hornicek@reactos.org>
Date: Sun, 6 Apr 2014 13:09:04 +0000
Subject: [PATCH] [WIN32K] - Fix a possible out of bounds read. CID 731665

svn path=/trunk/; revision=62651
---
 reactos/win32ss/gdi/ntgdi/freetype.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/reactos/win32ss/gdi/ntgdi/freetype.c b/reactos/win32ss/gdi/ntgdi/freetype.c
index 1e761e8f6d9..953b9e4c2be 100644
--- a/reactos/win32ss/gdi/ntgdi/freetype.c
+++ b/reactos/win32ss/gdi/ntgdi/freetype.c
@@ -533,19 +533,19 @@ IntTranslateCharsetInfo(PDWORD Src, /* [in]
     switch (Flags)
     {
     case TCI_SRCFONTSIG:
-        while (0 == (*Src >> Index & 0x0001) && Index < MAXTCIINDEX)
+        while (Index < MAXTCIINDEX && 0 == (*Src >> Index & 0x0001))
         {
             Index++;
         }
         break;
     case TCI_SRCCODEPAGE:
-        while ( *Src != FontTci[Index].ciACP && Index < MAXTCIINDEX)
+        while (Index < MAXTCIINDEX && *Src != FontTci[Index].ciACP)
         {
             Index++;
         }
         break;
     case TCI_SRCCHARSET:
-        while ( *Src != FontTci[Index].ciCharset && Index < MAXTCIINDEX)
+        while (Index < MAXTCIINDEX && *Src != FontTci[Index].ciCharset)
         {
             Index++;
         }