From 4c3cc50104a193dcffa988116b52b9ff3042a5f8 Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Mon, 2 Jul 2012 10:58:23 +0200
Subject: [PATCH] gdi32: Fix bitmap glyph allocation size in ExtTextOut
 fallback implementation.

---
 dlls/gdi32/font.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dlls/gdi32/font.c b/dlls/gdi32/font.c
index bb979022c15..5fefa2fab88 100644
--- a/dlls/gdi32/font.c
+++ b/dlls/gdi32/font.c
@@ -1799,7 +1799,7 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
                         const struct gdi_image_bits *image, const RECT *clip )
 {
     static const BYTE masks[8] = {0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01};
-    UINT x, y, i, count;
+    UINT x, y, i, count, max_count;
     BYTE *ptr = image->ptr;
     int stride = get_dib_stride( metrics->gmBlackBoxX, 1 );
     POINT *pts;
@@ -1812,8 +1812,8 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
     if (!clip) clipped_rect = rect;
     else if (!intersect_rect( &clipped_rect, &rect, clip )) return;
 
-    pts = HeapAlloc( GetProcessHeap(), 0,
-                     max(2,metrics->gmBlackBoxX) * metrics->gmBlackBoxY * sizeof(*pts) );
+    max_count = (metrics->gmBlackBoxX + 1) * metrics->gmBlackBoxY;
+    pts = HeapAlloc( GetProcessHeap(), 0, max_count * sizeof(*pts) );
     if (!pts) return;
 
     count = 0;
@@ -1833,6 +1833,7 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
             }
         }
     }
+    assert( count <= max_count );
     DPtoLP( hdc, pts, count );
     for (i = 0; i < count; i += 2) Polyline( hdc, pts + i, 2 );
     HeapFree( GetProcessHeap(), 0, pts );