[PATCH v2 1/6] quartz/vmr9: Fix copying from the d3d9 surface if the pitch doesn't match the width.

[Zebediah Figura]

Spotted by Henri Verbeet.

Fixes: 9b1ba3414953fe09cf8b95e781e5d9c0119cacfc
Signed-off-by: Zebediah Figura 
---
v2: actually remove the memcpy...

dlls/quartz/vmr9.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/dlls/quartz/vmr9.c b/dlls/quartz/vmr9.c
index 928e98f6056..bc2a905650c 100644
--- a/dlls/quartz/vmr9.c
+++ b/dlls/quartz/vmr9.c
@@ -627,7 +627,10 @@ static HRESULT WINAPI VMR9_GetStaticImage(BaseControlVideo *iface, LONG *size, L
     IDirect3DSurface9 *rt = NULL, *surface = NULL;
     D3DLOCKED_RECT locked_rect;
     IDirect3DDevice9 *device;
+    unsigned int row_size;
     BITMAPINFOHEADER bih;
+    LONG i, size_left;
+    char *dst;
     HRESULT hr;

TRACE("filter %p, size %d, image %p.\n", filter, *size, image);
@@ -661,10 +664,19 @@ static HRESULT WINAPI VMR9_GetStaticImage(BaseControlVideo *iface, LONG *size, L
     if (FAILED(hr = IDirect3DSurface9_LockRect(surface, &locked_rect, NULL, D3DLOCK_READONLY)))
         goto out;

-    memcpy(image, &bih, min(*size, sizeof(BITMAPINFOHEADER)));
-    if (*size > sizeof(BITMAPINFOHEADER))
-        memcpy((char *)image + sizeof(BITMAPINFOHEADER), locked_rect.pBits,
-                min(*size - sizeof(BITMAPINFOHEADER), bih.biSizeImage));
+    size_left = *size;
+    memcpy(image, &bih, min(size_left, sizeof(BITMAPINFOHEADER)));
+    size_left -= sizeof(BITMAPINFOHEADER);
+
+    dst = (char *)image + sizeof(BITMAPINFOHEADER);
+    row_size = bih.biWidth * bih.biBitCount / 8;
+
+    for (i = 0; i < bih.biHeight && size_left > 0; ++i)
+    {
+        memcpy(dst, (char *)locked_rect.pBits + (i * locked_rect.Pitch), min(row_size, size_left));
+        dst += row_size;
+        size_left -= row_size;
+    }

IDirect3DSurface9_UnlockRect(surface);