[Bug 45106] OOB write in gdi32 (CVE-2018-12933)