From f6ff22f92c17a8a051896d2334b6e53ffd96249a Mon Sep 17 00:00:00 2001
From: Elisha Riedlinger <elisha@novicemail.com>
Date: Fri, 13 Sep 2024 15:56:46 -0700
Subject: [PATCH] Ensure CopySurface does not exceed rect size

---
 Dllmain/BuildNo.rc            | 2 +-
 ddraw/IDirectDrawSurfaceX.cpp | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dllmain/BuildNo.rc b/Dllmain/BuildNo.rc
index 2cec405d..7549e697 100644
--- a/Dllmain/BuildNo.rc
+++ b/Dllmain/BuildNo.rc
@@ -1 +1 @@
-#define BUILD_NUMBER 7153 
+#define BUILD_NUMBER 7154 
diff --git a/ddraw/IDirectDrawSurfaceX.cpp b/ddraw/IDirectDrawSurfaceX.cpp
index 09ac36ef..8fea64d0 100644
--- a/ddraw/IDirectDrawSurfaceX.cpp
+++ b/ddraw/IDirectDrawSurfaceX.cpp
@@ -6245,7 +6245,7 @@ void ComplexCopy(T ColorKey, D3DLOCKED_RECT SrcLockRect, D3DLOCKED_RECT DestLock
 				DestBufferLoop[x] = PixelColor;
 			}
 		}
-		sx = (DWORD)((float)(y + 1) * HeightRatio + 0.5f);
+		sx = min((DWORD)((float)(y + 1) * HeightRatio + 0.5f), (DWORD)SrcRectHeight - 1);
 		SrcBufferLoop = reinterpret_cast<T*>((BYTE*)SrcLockRect.pBits + SrcLockRect.Pitch * (IsMirrorUpDown ? SrcRectHeight - sx - 1 : sx));
 		DestBufferLoop = reinterpret_cast<T*>((BYTE*)DestBufferLoop + DestLockRect.Pitch);
 	}