[PATCH 1/2] wineps: Fix buffer overflow in PSDRV_WriteDIBPatternDict function.

[Piotr Caban]

From: Piotr Caban

---
 dlls/wineps.drv/ps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/wineps.drv/ps.c b/dlls/wineps.drv/ps.c
index 7f7841d7ca7..829cc1173ef 100644
--- a/dlls/wineps.drv/ps.c
+++ b/dlls/wineps.drv/ps.c
@@ -974,7 +974,7 @@ BOOL PSDRV_WriteDIBPatternDict(PHYSDEV dev, const BITMAPINFO *bmi, BYTE *bits, U
     w = bmi->bmiHeader.biWidth & ~0x7;
     h = abs_height & ~0x7;

-    buf = HeapAlloc( GetProcessHeap(), 0, sizeof(do_pattern) + 100 );
+    buf = HeapAlloc( GetProcessHeap(), 0, max(sizeof(do_pattern) + 100, 2 * w/8 * h + 1) );
     ptr = buf;
     for(y = h-1; y >= 0; y--) {
         for(x = 0; x < w/8; x++) {