From 34b70728f386eda7b67eb77aa4ebae8c00c4a3d3 Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Wed, 10 Oct 2012 17:06:06 +0200
Subject: [PATCH] gdi32: Limit the allocation size to the useful data when
 converting DIB bits.

---
 dlls/gdi32/bitblt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dlls/gdi32/bitblt.c b/dlls/gdi32/bitblt.c
index 7a1f06fd90f..151434f070d 100644
--- a/dlls/gdi32/bitblt.c
+++ b/dlls/gdi32/bitblt.c
@@ -162,9 +162,12 @@ DWORD convert_bits( const BITMAPINFO *src_info, struct bitblt_coords *src,
 {
     void *ptr;
     DWORD err;
+    BOOL top_down = dst_info->bmiHeader.biHeight < 0;
 
     dst_info->bmiHeader.biWidth = src->visrect.right - src->visrect.left;
+    dst_info->bmiHeader.biHeight = src->visrect.bottom - src->visrect.top;
     dst_info->bmiHeader.biSizeImage = get_dib_image_size( dst_info );
+    if (top_down) dst_info->bmiHeader.biHeight = -dst_info->bmiHeader.biHeight;
 
     if (!(ptr = HeapAlloc( GetProcessHeap(), 0, dst_info->bmiHeader.biSizeImage )))
         return ERROR_OUTOFMEMORY;