Skipped content of type multipart/alternative----------- next part -----------
diff --git a/dlls/winex11.drv/dib.c b/dlls/winex11.drv/dib.c
index cec2058..809897e 100644
--- a/dlls/winex11.drv/dib.c
+++ b/dlls/winex11.drv/dib.c
@@ -3861,6 +3861,7 @@ INT X11DRV_SetDIBits( X11DRV_PDEVICE *ph
X11DRV_DIB_IMAGEBITS_DESCR descr;
BITMAP bitmap;
LONG width, height, tmpheight;
+ int nrsrcbytes, dibpitch;
INT result;

descr.physDev = physDev;
@@ -3880,6 +3881,16 @@ INT X11DRV_SetDIBits( X11DRV_PDEVICE *ph

if (startscan + lines > height) lines = height - startscan;

+ /* pointer check */
+ dibpitch = ((width * descr.infoBpp + 31) &~31) / 8;
+ if( descr.compression)
+ nrsrcbytes = 1;
+ else {
+ nrsrcbytes = lines * dibpitch;
+ if( nrsrcbytes < 0) nrsrcbytes = - nrsrcbytes;
+ }
+ if( IsBadReadPtr( bits, nrsrcbytes)) return 0;
+
switch (descr.infoBpp)
{
case 1:
@@ -3926,7 +3937,7 @@ INT X11DRV_SetDIBits( X11DRV_PDEVICE *ph
descr.width = bitmap.bmWidth;
descr.height = lines;
descr.useShm = FALSE;
- descr.dibpitch = ((descr.infoWidth * descr.infoBpp + 31) &~31) / 8;
+ descr.dibpitch = dibpitch;
X11DRV_DIB_Lock( physBitmap, DIB_Status_GdiMod, FALSE );
result = X11DRV_DIB_SetImageBits( &descr );
X11DRV_DIB_Unlock( physBitmap, TRUE );

cd wine
sudo debian/rules clean
sudo debian/rules build
sudo debian/rules binary