From f2f50f18dc1a6fab7a0ec68d8e8764e0f3399481 Mon Sep 17 00:00:00 2001
From: Rob Shearman <robertshearman@gmail.com>
Date: Sun, 29 Nov 2009 10:28:32 +0000
Subject: [PATCH] ntdll: Don't read beyond the end of the array on the last ace
 iteration in RtlValidAcl.

---
 dlls/ntdll/sec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/sec.c b/dlls/ntdll/sec.c
index 950b9dd2b85..64efdb58cee 100644
--- a/dlls/ntdll/sec.c
+++ b/dlls/ntdll/sec.c
@@ -1328,7 +1328,8 @@ BOOLEAN WINAPI RtlValidAcl(PACL pAcl)
                             ret = FALSE;
                             break;
                         }
-                        ace = (PACE_HEADER)(((BYTE*)ace)+ace->AceSize);
+                        if (i != pAcl->AceCount)
+                            ace = (PACE_HEADER)(((BYTE*)ace)+ace->AceSize);
                     }
                 }
 	}