wined3d: Better validation of BltFast destination

[Iain Arnell]

fixes #23238 -  Repton 3: crashes when viewing map.
---
 dlls/ddraw/tests/dsurface.c |    6 ++++++
 dlls/wined3d/surface_base.c |    5 +++++
 2 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/dlls/ddraw/tests/dsurface.c b/dlls/ddraw/tests/dsurface.c
index bfd5eae..ac9507c 100644
--- a/dlls/ddraw/tests/dsurface.c
+++ b/dlls/ddraw/tests/dsurface.c
@@ -2537,6 +2537,12 @@ static void BltParamTest(void)
     ok(hr == DDERR_INVALIDRECT, "BltFast with a rectangle resulting in an off-surface write returned %08x\n", hr);
     hr = IDirectDrawSurface_BltFast(surface1, 90, 90, surface2, NULL, 0);
     ok(hr == DDERR_INVALIDRECT, "BltFast with a rectangle resulting in an off-surface write returned %08x\n", hr);
+    hr = IDirectDrawSurface_BltFast(surface1, -10, 0, surface2, NULL, 0);
+    ok(hr == DDERR_INVALIDRECT, "BltFast with an offset resulting in an off-surface write returned %08x\n", hr);
+    hr = IDirectDrawSurface_BltFast(surface1, 0, -10, surface2, NULL, 0);
+    ok(hr == DDERR_INVALIDRECT, "BltFast with an offset resulting in an off-surface write returned %08x\n", hr);
+    hr = IDirectDrawSurface_BltFast(surface2, 20, 20, surface1, &valid, 0);
+    ok(hr == DD_OK, "BltFast from bigger to smaller surface using a valid rectangle and offset returned %08x\n", hr);
     hr = IDirectDrawSurface_BltFast(surface2, 0, 0, surface1, &invalid1, 0);
     ok(hr == DDERR_INVALIDRECT, "BltFast with invalid rectangle 1 returned %08x\n", hr);
     hr = IDirectDrawSurface_BltFast(surface2, 0, 0, surface1, &invalid2, 0);
diff --git a/dlls/wined3d/surface_base.c b/dlls/wined3d/surface_base.c
index 10d1141..2a17452 100644
--- a/dlls/wined3d/surface_base.c
+++ b/dlls/wined3d/surface_base.c
@@ -1657,6 +1657,11 @@ HRESULT WINAPI IWineD3DBaseSurfaceImpl_BltFast(IWineD3DSurface *iface, DWORD dst
     lock_dst.right = dstx + w;
     lock_dst.bottom = dsty + h;
 
+    if ( lock_dst.left < 0 || lock_dst.top < 0 ) {
+        WARN("Application gave us bad desitination offset for BltFast.\n");
+        return WINEDDERR_INVALIDRECT;
+    }
+
     bpp = This->resource.format_desc->byte_count;
 
     /* We need to lock the surfaces, or we won't get refreshes when done. */
-- 
1.7.0.1