From: Alistair Leslie-Hughes leslie_alistair@hotmail.com
This appear to be introduced with commit 12f73ed9d851.
When This->stride is negative (bottom up image) it converts the multiplication to an UINT. Thus causing the pointer to be incorrect when y > 0. --- dlls/windowscodecs/bmpdecode.c | 2 +- dlls/windowscodecs/wincodecs_common.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/dlls/windowscodecs/bmpdecode.c b/dlls/windowscodecs/bmpdecode.c index 9d4867447f0..ae6feda5b50 100644 --- a/dlls/windowscodecs/bmpdecode.c +++ b/dlls/windowscodecs/bmpdecode.c @@ -432,7 +432,7 @@ static HRESULT BmpFrameDecode_ReadABGRasBGR(BmpDecoder* This) { for (y = 0; y < height; y++) { - pixel = This->imagedatastart + This->stride * y; + pixel = This->imagedatastart + This->stride * (INT)y;
for (x = 0; x < width; x++) { diff --git a/dlls/windowscodecs/wincodecs_common.h b/dlls/windowscodecs/wincodecs_common.h index f56e91e1f54..dcccdc2e5f1 100644 --- a/dlls/windowscodecs/wincodecs_common.h +++ b/dlls/windowscodecs/wincodecs_common.h @@ -201,7 +201,7 @@ void reverse_bgr8(UINT bytesperpixel, LPBYTE bits, UINT width, UINT height, INT
for (y=0; y<height; y++) { - pixel = bits + stride * y; + pixel = bits + stride * (INT)y;
for (x=0; x<width; x++) {