From 84d2cf02ed2dbe19c0a67e71395d461157e17e58 Mon Sep 17 00:00:00 2001
From: "Shawn M. Chapla" <schapla@codeweavers.com>
Date: Wed, 26 Aug 2020 19:21:42 -0400
Subject: [PATCH] gdi32: Pass correct pointer to PolyDraw during EMR_POLYDRAW
 playback.

Signed-off-by: Shawn M. Chapla <schapla@codeweavers.com>
Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/gdi32/enhmetafile.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dlls/gdi32/enhmetafile.c b/dlls/gdi32/enhmetafile.c
index fc3389ff23f..4d6531644b9 100644
--- a/dlls/gdi32/enhmetafile.c
+++ b/dlls/gdi32/enhmetafile.c
@@ -1622,9 +1622,12 @@ BOOL WINAPI PlayEnhMetaFileRecord(
     case EMR_POLYDRAW:
       {
         const EMRPOLYDRAW *lpPolyDraw = (const EMRPOLYDRAW *)mr;
+
+        /* NB abTypes array doesn't start at lpPolyDraw->abTypes. It's actually
+           lpPolyDraw->aptl + lpPolyDraw->cptl. */
         PolyDraw( hdc,
                   (const POINT*)lpPolyDraw->aptl,
-                  lpPolyDraw->abTypes,
+                  (BYTE*)(lpPolyDraw->aptl + lpPolyDraw->cptl),
                   (INT)lpPolyDraw->cptl );
 
         break;