Alexandre Julliard : gdi32: Limit the allocation size to the useful data when converting DIB bits.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 34b70728f386eda7b67eb77aa4ebae8c00c4a3d3
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=34b70728f386eda7b67eb77aa4ebae8c00c4a3d3

Author: Alexandre Julliard <julliard at winehq.org>
Date:   Wed Oct 10 17:06:06 2012 +0200

gdi32: Limit the allocation size to the useful data when converting DIB bits.

---

 dlls/gdi32/bitblt.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/dlls/gdi32/bitblt.c b/dlls/gdi32/bitblt.c
index 7a1f06f..151434f 100644
--- a/dlls/gdi32/bitblt.c
+++ b/dlls/gdi32/bitblt.c
@@ -162,9 +162,12 @@ DWORD convert_bits( const BITMAPINFO *src_info, struct bitblt_coords *src,
 {
     void *ptr;
     DWORD err;
+    BOOL top_down = dst_info->bmiHeader.biHeight < 0;
 
     dst_info->bmiHeader.biWidth = src->visrect.right - src->visrect.left;
+    dst_info->bmiHeader.biHeight = src->visrect.bottom - src->visrect.top;
     dst_info->bmiHeader.biSizeImage = get_dib_image_size( dst_info );
+    if (top_down) dst_info->bmiHeader.biHeight = -dst_info->bmiHeader.biHeight;
 
     if (!(ptr = HeapAlloc( GetProcessHeap(), 0, dst_info->bmiHeader.biSizeImage )))
         return ERROR_OUTOFMEMORY;