Comment 2 for bug 681150

Thanks for this report! Since the w and h variables are unsigned, this is actually "just" a denial of service crash, since the loop that copies out the data will run until it segfaults, so the results aren't controllable.