[PATCH v3] gdi32: Avoid exceeding the actual bitmap height.

[Huw Davies]

From: Haoyang Chen

The bottom-up case is handled earlier on.  For the top-down
case, 'lines' is left untouched.

Signed-off-by: Haoyang Chen 
Signed-off-by: Huw Davies 
---
 dlls/gdi32/dib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/gdi32/dib.c b/dlls/gdi32/dib.c
index 10a7a957973..790ecf06501 100644
--- a/dlls/gdi32/dib.c
+++ b/dlls/gdi32/dib.c
@@ -824,7 +824,7 @@ INT CDECL nulldrv_SetDIBitsToDevice( PHYSDEV dev, INT x_dst, INT y_dst, DWORD cx
             }
             else if (src.y >= lines) return lines;
         }
-        src_info->bmiHeader.biHeight = top_down ? -lines : lines;
+        src_info->bmiHeader.biHeight = top_down ? -min( lines, height ) : lines;
         src_info->bmiHeader.biSizeImage = get_dib_image_size( src_info );
     }