From ea1f78da72aa9de2033c288128340bbd49b4e78a Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sun, 11 Jun 2017 06:05:42 +0000
Subject: [PATCH] [WIN32K:NTUSER] - Include the CLIPBOARDDATA structure itself
 when calculating the size passed to UserCreateObject in IntSynthesizeDib.
 Fixes user heap corruption when running user32_winetest:clipboard. CORE-13408

svn path=/trunk/; revision=74990
---
 reactos/win32ss/user/ntuser/clipboard.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/reactos/win32ss/user/ntuser/clipboard.c b/reactos/win32ss/user/ntuser/clipboard.c
index b9ba6f952a9..e6809f4087a 100644
--- a/reactos/win32ss/user/ntuser/clipboard.c
+++ b/reactos/win32ss/user/ntuser/clipboard.c
@@ -180,7 +180,7 @@ IntSynthesizeDib(
                                                       NULL,
                                                       &hMem,
                                                       TYPE_CLIPDATA,
-                                                      cjDataSize);
+                                                      sizeof(CLIPBOARDDATA) + cjDataSize);
     if (!pClipboardData)
     {
         goto cleanup;