gdi32: fix minor read buffer overrun in CombineRgn

[Dan Kegel]

Looks like somebody just forgot a limit test, leading
to a (benign?) read buffer overrun.

Fixes http://bugs.winehq.org/show_bug.cgi?id=20851
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-gdi32-fix-buffer-overrun-in-CombineRgn.patch
Type: text/x-patch
Size: 719 bytes
Desc: not available
URL: <http://www.winehq.org/pipermail/wine-patches/attachments/20091127/84c5a08d/attachment.bin>