win32k: crash when taking a screenshot

To reproduce: in VGA mode, press Alt+PrintScreen.

In IntSynthesizeDib() in clipboard.c:

BITMAPINFO bi;
...
NtGdiGetDIBitsInternal(..., ..., ..., ..., ..., &bi, ..., ..., ...);

In NtGdiGetDIBitsInternal() in dibobj.c:

colorPtr = (LPBYTE)Info + Info->bmiHeader.biSize;
...
rgbQuads = colorPtr;
...

for (i = 0; i < pDcPal->NumColors; i++)
{
...
rgbQuads[i].rgbRed = ...; // line 735

BITMAPINFO is

typedef struct tagBITMAPINFO

{ BITMAPINFOHEADER bmiHeader; RGBQUAD bmiColors[1]; }

BITMAPINFO,*LPBITMAPINFO,*PBITMAPINFO;

There is not enough place for that.