Buffer overflow in get_relationTargetsOfType

Bug: 889089
Change-Id: I8dccdccb7de9f742cf6657106739039b59fcd824
Reviewed-on: https://chromium-review.googlesource.com/1243584
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#594005}

ui/accessibility/platform/ax_platform_node_win.cc

@@ -1178,7 +1178,8 @@ IFACEMETHODIMP AXPlatformNodeWin::get_relationTargetsOfType(BSTR type_bstr,
     if (target) {
       (*targets)[index] = static_cast<IAccessible*>(target);
       (*targets)[index]->AddRef();
-      index++;
+      if (++index > count)
+        break;
     }
   }
   *n_targets = index;