Fix wxBitmap ctor from XBM in wxGTK

Width and height were exchanged in the loops, so the conversion code didn't
work correctly and overflowed the pixel buffer (due to extra padding in the
row stride) for non-square bitmaps. It also resulted in a completely wrong
bitmap appearance, but somehow this managed to go unnoticed, unlike the memory
errors.

See #17633.

(cherry picked from commit f9740e8180)

docs/changes.txt

@@ -619,6 +619,7 @@ wxGTK:
 
 - Fix infinite sizing loop with GTK3 when using wxScrolled with a non-default
   target window.
+- Fix wxBitmap ctor from XBM for non-square bitmaps.
 - Fix crashes in wxGTK3 when running with non-X11 backend (Marco Trevisan).
 - Fix coordinates of wxSetCursorEvent propagated to parent windows.
 - Fix GTK+ warnings when refreshing wxListCtrl items (Scott Talbert).

src/gtk/bitmap.cpp

@@ -428,17 +428,18 @@ wxBitmap::wxBitmap(const char bits[], int width, int height, int depth)
         const char* src = bits;
         guchar* dst = gdk_pixbuf_get_pixels(pixbuf);
         const int stride_src = (width + 7) / 8;
-        const int rowinc_dst = gdk_pixbuf_get_rowstride(pixbuf) - 3 * width;
-        for (int j = 0; j < width; j++, src += stride_src, dst += rowinc_dst)
+        const int stride_dst = gdk_pixbuf_get_rowstride(pixbuf);
+        for (int j = 0; j < height; j++, src += stride_src, dst += stride_dst)
         {
-            for (int i = 0; i < height; i++)
+            guchar* d = dst;
+            for (int i = 0; i < width; i++)
             {
                 guchar c = 0xff;
                 if (src[i >> 3] & (1 << (i & 7)))
                     c = 0;
-                *dst++ = c;
-                *dst++ = c;
-                *dst++ = c;
+                *d++ = c;
+                *d++ = c;
+                *d++ = c;
             }
         }
 #else