fdo#86298 Avoid crash blending upside down Bitmaps of differing size

Change-Id: I3ed0dec7c2f8d80ca104f8ba8d47894ace582c0a
Reviewed-on: https://gerrit.libreoffice.org/12961Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

vcl/source/gdi/bmpfast.cxx

@@ -566,7 +566,7 @@ bool ImplBlendToBitmap( TrueColorPixelPtr<SRCFMT>& rSrcLine,
     // source and destination don't match: upside down
     if( (rSrcBuffer.mnFormat ^ rDstBuffer.mnFormat) & BMP_FORMAT_TOP_DOWN )
     {
-        aDstLine.AddByteOffset( (rSrcBuffer.mnHeight - 1) * nDstLinestep );
+        aDstLine.AddByteOffset( (rDstBuffer.mnHeight - 1) * nDstLinestep );
         nDstLinestep = -nDstLinestep;
     }