[Bug 28766] DIB engine multiple invalid memory accesses

https://bugs.winehq.org/show_bug.cgi?id=28766

--- Comment #4 from Austin English  ---
Another one:
==30078== Invalid read of size 4
==30078==    at 0x53EF595: CreatePolyPolygonRgn (region.c:2672)
==30078==    by 0x53E79DA: PATH_PathToRegion (path.c:412)
==30078==    by 0x53E7A69: PATH_FillPath (path.c:677)
==30078==    by 0x53E98CB: nulldrv_FillPath (path.c:2149)
==30078==    by 0x53E91B2: FillPath (path.c:746)
==30078==    by 0x4DB0765: test_path_state (path.c:230)
==30078==    by 0x4DB0FB8: func_path (path.c:740)
==30078==    by 0x4D57467: main (test.h:584)
==30078==  Address 0x4823a08 is 16 bytes after a block of size 16 alloc'd
==30078==    at 0x7BC4D7D7: RtlAllocateHeap (heap.c:233)
==30078==    by 0x53E770B: alloc_gdi_path (path.c:122)
==30078==    by 0x53E7784: PATH_FlattenPath (path.c:339)
==30078==    by 0x53E790B: PATH_PathToRegion (path.c:377)
==30078==    by 0x53E7A69: PATH_FillPath (path.c:677)
==30078==    by 0x53E98CB: nulldrv_FillPath (path.c:2149)
==30078==    by 0x53E91B2: FillPath (path.c:746)
==30078==    by 0x4DB0765: test_path_state (path.c:230)
==30078==    by 0x4DB0FB8: func_path (path.c:740)
==30078==    by 0x4D57467: main (test.h:584)
==30078== 
{