From e23ccb787d2c95f9c71312340cc192810407bb8b Mon Sep 17 00:00:00 2001
From: Vincent Povirk <vincent@codeweavers.com>
Date: Fri, 4 Sep 2009 09:49:32 -0500
Subject: [PATCH] gdiplus: Fix a copy outside allocated memory in
 GdipCreateTextureIA.

---
 dlls/gdiplus/brush.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/gdiplus/brush.c b/dlls/gdiplus/brush.c
index 370de616f42..5e6b26aa51c 100644
--- a/dlls/gdiplus/brush.c
+++ b/dlls/gdiplus/brush.c
@@ -735,7 +735,7 @@ GpStatus WINGDIPAPI GdipCreateTextureIA(GpImage *image,
 
     /* image is flipped */
     if(pbmi->bmiHeader.biHeight > 0){
-        dibits += pbmi->bmiHeader.biSizeImage;
+        dibits += image_stride * (pbmi->bmiHeader.biHeight - 1);
         image_stride *= -1;
         textbits += stride * (n_height - 1);
         stride *= -1;