From 4847c9ec6428bee7a354219159ac4f97b22ff09e Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Thu, 1 May 2014 19:44:30 +0000
Subject: [PATCH] [USP10] - Fix buffer overflow in _ItemizeInternal CORE-8133
 #resolve

svn path=/trunk/; revision=63096
---
 reactos/dll/win32/usp10/usp10.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/reactos/dll/win32/usp10/usp10.c b/reactos/dll/win32/usp10/usp10.c
index 406ad1c0ee5..4a574809edf 100644
--- a/reactos/dll/win32/usp10/usp10.c
+++ b/reactos/dll/win32/usp10/usp10.c
@@ -1605,12 +1605,12 @@ static HRESULT _ItemizeInternal(const WCHAR *pwcInChars, int cInChars,
      * item is set up to prevent random behaviour if the caller erroneously
      * checks the n+1 structure                                              */
     index++;
+    if (index + 1 > cMaxItems) return E_OUTOFMEMORY;
     memset(&pItems[index].a, 0, sizeof(SCRIPT_ANALYSIS));
 
     TRACE("index=%d cnt=%d iCharPos=%d\n", index, cnt, pItems[index].iCharPos);
 
     /*  Set one SCRIPT_STATE item being returned  */
-    if  (index + 1 > cMaxItems) return E_OUTOFMEMORY;
     if (pcItems) *pcItems = index;
 
     /*  Set SCRIPT_ITEM                                     */