diff --git a/desktop/qa/desktop_lib/test_desktop_lib.cxx b/desktop/qa/desktop_lib/test_desktop_lib.cxx
index 28948099b5e3..a8c2015f93fd 100644
--- a/desktop/qa/desktop_lib/test_desktop_lib.cxx
+++ b/desktop/qa/desktop_lib/test_desktop_lib.cxx
@@ -61,6 +61,7 @@ public:
     void testGetFilterTypes();
     void testGetPartPageRectangles();
     void testSearchCalc();
+    void testPaintTile();
 
     CPPUNIT_TEST_SUITE(DesktopLOKTest);
     CPPUNIT_TEST(testGetStyles);
@@ -69,6 +70,7 @@ public:
     CPPUNIT_TEST(testGetFilterTypes);
     CPPUNIT_TEST(testGetPartPageRectangles);
     CPPUNIT_TEST(testSearchCalc);
+    CPPUNIT_TEST(testPaintTile);
     CPPUNIT_TEST_SUITE_END();
 
     uno::Reference<lang::XComponent> mxComponent;
@@ -280,6 +282,25 @@ void DesktopLOKTest::testSearchCalc()
     comphelper::LibreOfficeKit::setActive(false);
 }
 
+void DesktopLOKTest::testPaintTile()
+{
+    LibLODocument_Impl* pDocument = loadDoc("blank_text.odt");
+    int nCanvasWidth = 100;
+    int nCanvasHeight = 300;
+    std::vector<unsigned char> aBuffer(nCanvasWidth * nCanvasHeight * 4);
+    int nTilePosX = 0;
+    int nTilePosY = 0;
+    int nTileWidth = 1000;
+    int nTileHeight = 3000;
+
+    // This used to crash: painTile() implementation did not handle
+    // nCanvasWidth != nCanvasHeight correctly, as usually both are just always
+    // 256.
+    pDocument->pClass->paintTile(pDocument, aBuffer.data(), nCanvasWidth, nCanvasHeight, nTilePosX, nTilePosY, nTileWidth, nTileHeight);
+
+    closeDoc();
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(DesktopLOKTest);
 
 CPPUNIT_PLUGIN_IMPLEMENT();
diff --git a/desktop/source/lib/init.cxx b/desktop/source/lib/init.cxx
index dc738921a04f..8713bb52fd74 100644
--- a/desktop/source/lib/init.cxx
+++ b/desktop/source/lib/init.cxx
@@ -789,7 +789,7 @@ void doc_paintTile (LibreOfficeKitDocument* pThis,
     {
         for (int nCol = 0; nCol < nCanvasWidth; ++nCol)
         {
-            const int nOffset = (nCanvasHeight * nRow) + nCol;
+            const int nOffset = (nCanvasWidth * nRow) + nCol;
             // VCL's transparent is 0, RGBA's transparent is 0xff.
             pBuffer[nOffset * 4 +3] = 0xff - aAlpha[nOffset];
         }