Piotr Caban : wineps: Fix buffer overflow in PSDRV_WriteDIBPatternDict function.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 5d68939dfd19dc5fdac93d61fce0291acdeaece0
URL:    https://gitlab.winehq.org/wine/wine/-/commit/5d68939dfd19dc5fdac93d61fce0291...

Author: Piotr Caban 
Date:   Fri Mar 10 17:17:54 2023 +0100

wineps: Fix buffer overflow in PSDRV_WriteDIBPatternDict function.

---

dlls/wineps.drv/ps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/wineps.drv/ps.c b/dlls/wineps.drv/ps.c
index 7f7841d7ca7..829cc1173ef 100644
--- a/dlls/wineps.drv/ps.c
+++ b/dlls/wineps.drv/ps.c
@@ -974,7 +974,7 @@ BOOL PSDRV_WriteDIBPatternDict(PHYSDEV dev, const BITMAPINFO *bmi, BYTE *bits, U
     w = bmi->bmiHeader.biWidth & ~0x7;
     h = abs_height & ~0x7;

-    buf = HeapAlloc( GetProcessHeap(), 0, sizeof(do_pattern) + 100 );
+    buf = HeapAlloc( GetProcessHeap(), 0, max(sizeof(do_pattern) + 100, 2 * w/8 * h + 1) );
     ptr = buf;
     for(y = h-1; y >= 0; y--) {
         for(x = 0; x < w/8; x++) {