From: Alistair Leslie-Hughes <leslie_alistair(a)hotmail.com> This appear to be introduced with commit 12f73ed9d851. When This->stride is negative (bottom up image) it converts the multiplication to an UINT. Thus causing the pointer to be incorrect when y > 0. --- dlls/windowscodecs/bmpdecode.c | 2 +- dlls/windowscodecs/wincodecs_common.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/windowscodecs/bmpdecode.c b/dlls/windowscodecs/bmpdecode.c index 9d4867447f0..ae6feda5b50 100644 --- a/dlls/windowscodecs/bmpdecode.c +++ b/dlls/windowscodecs/bmpdecode.c @@ -432,7 +432,7 @@ static HRESULT BmpFrameDecode_ReadABGRasBGR(BmpDecoder* This) { for (y = 0; y < height; y++) { - pixel = This->imagedatastart + This->stride * y; + pixel = This->imagedatastart + This->stride * (INT)y; for (x = 0; x < width; x++) { diff --git a/dlls/windowscodecs/wincodecs_common.h b/dlls/windowscodecs/wincodecs_common.h index f56e91e1f54..dcccdc2e5f1 100644 --- a/dlls/windowscodecs/wincodecs_common.h +++ b/dlls/windowscodecs/wincodecs_common.h @@ -201,7 +201,7 @@ void reverse_bgr8(UINT bytesperpixel, LPBYTE bits, UINT width, UINT height, INT for (y=0; y<height; y++) { - pixel = bits + stride * y; + pixel = bits + stride * (INT)y; for (x=0; x<width; x++) { -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/5568