image: Use correct size for allocation

In 06e9caf the type of the variables
was changed, but the type used to compute the allocation size was not.

Fixes a crash in user-font-mask (test-fallback backend).

src/cairo-image-surface.c

@@ -4255,7 +4255,7 @@ _cairo_image_surface_fill_rectangles (void		      *abstract_surface,
     cairo_image_surface_t *surface = abstract_surface;
 
     pixman_color_t pixman_color;
-    pixman_box32_t stack_boxes[CAIRO_STACK_ARRAY_LENGTH (pixman_rectangle16_t)];
+    pixman_box32_t stack_boxes[CAIRO_STACK_ARRAY_LENGTH (pixman_box32_t)];
     pixman_box32_t *pixman_boxes = stack_boxes;
     int i;
 
@@ -4270,7 +4270,7 @@ _cairo_image_surface_fill_rectangles (void		      *abstract_surface,
     pixman_color.alpha = color->alpha_short;
 
     if (num_rects > ARRAY_LENGTH (stack_boxes)) {
-	pixman_boxes = _cairo_malloc_ab (num_rects, sizeof (pixman_rectangle16_t));
+	pixman_boxes = _cairo_malloc_ab (num_rects, sizeof (pixman_box32_t));
 	if (unlikely (pixman_boxes == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }