gdi32: Prevent integer overflow in CreateBitmapIndirect.

diff --git a/dlls/gdi32/bitmap.c b/dlls/gdi32/bitmap.c
index e7370a246503bd67bd98960026557379441e85fb..2a083c5059164824112ea2be1c7d690caeb9b342 100644 (file)
--- a/dlls/gdi32/bitmap.c
+++ b/dlls/gdi32/bitmap.c
@@ -274,7 +274,7 @@ HBITMAP WINAPI CreateBitmapIndirect( const BITMAP *bmp )
     /* Windows ignores the provided bm.bmWidthBytes */
     bm.bmWidthBytes = BITMAP_GetWidthBytes( bm.bmWidth, bm.bmBitsPixel );
     /* XP doesn't allow to create bitmaps larger than 128 Mb */
-    if (bm.bmHeight * bm.bmWidthBytes > 128 * 1024 * 1024)
+    if (bm.bmHeight > 128 * 1024 * 1024 / bm.bmWidthBytes)
     {
         SetLastError( ERROR_NOT_ENOUGH_MEMORY );
         return 0;