Microsoft Windows gdi32.dll suffers from a heap-based out-of-bounds reads / memory disclosure in EMR_SETDIBITSTODEVICE and possibly other records.