CreateBrushInderect integer overflow on WMF files parsing.
vulners.com/securityvulns/securityvulns:doc:13763
vulners.com/securityvulns/securityvulns:doc:13764