usp10: ScriptShape needs a number of SCRIPT_VISATTR equal to glyphs not chars.
diff --git a/dlls/usp10/usp10.c b/dlls/usp10/usp10.c
index fe8f6a8..b8eee22 100644
--- a/dlls/usp10/usp10.c
+++ b/dlls/usp10/usp10.c
@@ -991,7 +991,7 @@
             WORD *glyphs = heap_alloc_zero(sizeof(WORD) * numGlyphs);
             WORD *pwLogClust = heap_alloc_zero(sizeof(WORD) * cChar);
             int *piAdvance = heap_alloc_zero(sizeof(int) * numGlyphs);
-            SCRIPT_VISATTR *psva = heap_alloc_zero(sizeof(SCRIPT_VISATTR) * cChar);
+            SCRIPT_VISATTR *psva = heap_alloc_zero(sizeof(SCRIPT_VISATTR) * numGlyphs);
             GOFFSET *pGoffset = heap_alloc_zero(sizeof(GOFFSET) * numGlyphs);
             ABC *abc = heap_alloc_zero(sizeof(ABC));
             int numGlyphsReturned;