https://bugs.freedesktop.org/show_bug.cgi?id=73781
--- Comment #2 from Michel Dänzer michel@daenzer.net --- (In reply to comment #0)
Created attachment 92368 [details]
I don't see how ((0x0000ffff << 2) / pitch) can be > 0xfffffff8, so I'm afraid this isn't a proper fix but just avoids the problem by accident.
I think a proper solution would need to set cheight to 1 if (pitch > (0x0000ffff << 2)) and do several copies for each line.
BTW, in general it's better to submit patches directly to the mesa-dev mailing list than to attach them in bugzilla.