gdi32: Fix bitmap glyph allocation size in ExtTextOut fallback implementation.

dlls/gdi32/font.c

@@ -1799,7 +1799,7 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
                         const struct gdi_image_bits *image, const RECT *clip )
 {
     static const BYTE masks[8] = {0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01};
-    UINT x, y, i, count;
+    UINT x, y, i, count, max_count;
     BYTE *ptr = image->ptr;
     int stride = get_dib_stride( metrics->gmBlackBoxX, 1 );
     POINT *pts;
@@ -1812,8 +1812,8 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
     if (!clip) clipped_rect = rect;
     else if (!intersect_rect( &clipped_rect, &rect, clip )) return;
 
-    pts = HeapAlloc( GetProcessHeap(), 0,
-                     max(2,metrics->gmBlackBoxX) * metrics->gmBlackBoxY * sizeof(*pts) );
+    max_count = (metrics->gmBlackBoxX + 1) * metrics->gmBlackBoxY;
+    pts = HeapAlloc( GetProcessHeap(), 0, max_count * sizeof(*pts) );
     if (!pts) return;
 
     count = 0;
@@ -1833,6 +1833,7 @@ static void draw_glyph( HDC hdc, INT origin_x, INT origin_y, const GLYPHMETRICS
             }
         }
     }
+    assert( count <= max_count );
     DPtoLP( hdc, pts, count );
     for (i = 0; i < count; i += 2) Polyline( hdc, pts + i, 2 );
     HeapFree( GetProcessHeap(), 0, pts );