From 2a492b6e8bfbb989bf744d2383b7c9a51ad517cc Mon Sep 17 00:00:00 2001
From: Esme Povirk <esme@codeweavers.com>
Date: Sat, 3 Feb 2024 20:37:27 +0000
Subject: [PATCH] metadata: Fix bounds checking in
 mono_guid_signature_append_type.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=55736
---
 mono/metadata/metadata.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mono/metadata/metadata.c b/mono/metadata/metadata.c
index b503071dfbdf..642109539bab 100644
--- a/mono/metadata/metadata.c
+++ b/mono/metadata/metadata.c
@@ -8205,7 +8205,8 @@ mono_guid_signature_append_type (GString *res, MonoType *type)
 		for (i = 0; i < type->data.array->rank; ++i)
 		{
 			if (i > 0) g_string_append_c (res, ',');
-			if (type->data.array->sizes[i] == 0 || type->data.array->lobounds[i] == 0) continue;
+			if (i >= type->data.array->numsizes || type->data.array->sizes[i] == 0 ||
+				i >= type->data.array->numlobounds || type->data.array->lobounds[i] == 0) continue;
                         g_string_append_printf (res, "%d", type->data.array->lobounds[i]);
                         g_string_append (res, "...");
                         g_string_append_printf (res, "%d", type->data.array->lobounds[i] + type->data.array->sizes[i] + 1);