[Bug 20850] Write buffer overflow in WidenPath()

http://bugs.winehq.org/show_bug.cgi?id=20850

--- Comment #1 from Nikolay Sivov   2009-11-28 01:43:44 ---
(In reply to comment #0)
> Looking at WidenPath(), it seems that maybe numStrokes should
> start at 1, not 0?

Yeah, I think you're right, this looks pretty odd:
---
    numStrokes = 0;

pStrokes = HeapAlloc(GetProcessHeap(), 0, numStrokes * sizeof(GdiPath*));
---