Stefan Dösinger : wined3d: Perform sanity checks on the rectangle in LockRect.
Alexandre Julliard
julliard at wine.codeweavers.com
Fri Jun 30 14:15:20 CDT 2006
Module: wine
Branch: refs/heads/master
Commit: 77448f588b888ecc724c7ead9f28629f3f661d27
URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=77448f588b888ecc724c7ead9f28629f3f661d27
Author: Stefan Dösinger <stefandoesinger at gmx.at>
Date: Thu Jun 29 21:13:12 2006 +0200
wined3d: Perform sanity checks on the rectangle in LockRect.
---
dlls/wined3d/surface.c | 11 +++++++++++
dlls/wined3d/surface_gdi.c | 11 +++++++++++
2 files changed, 22 insertions(+), 0 deletions(-)
diff --git a/dlls/wined3d/surface.c b/dlls/wined3d/surface.c
index da8f766..e3c8682 100644
--- a/dlls/wined3d/surface.c
+++ b/dlls/wined3d/surface.c
@@ -348,6 +348,17 @@ static HRESULT WINAPI IWineD3DSurfaceImp
} else {
TRACE("Lock Rect (%p) = l %ld, t %ld, r %ld, b %ld\n", pRect, pRect->left, pRect->top, pRect->right, pRect->bottom);
+ if ((pRect->top < 0) ||
+ (pRect->left < 0) ||
+ (pRect->left >= pRect->right) ||
+ (pRect->top >= pRect->bottom) ||
+ (pRect->right > This->currentDesc.Width) ||
+ (pRect->bottom > This->currentDesc.Height))
+ {
+ WARN(" Invalid values in pRect !!!\n");
+ return D3DERR_INVALIDCALL;
+ }
+
if (This->resource.format == WINED3DFMT_DXT1) { /* DXT1 is half byte per pixel */
pLockedRect->pBits = This->resource.allocatedMemory + (pLockedRect->Pitch * pRect->top) + ((pRect->left * This->bytesPerPixel / 2));
} else {
diff --git a/dlls/wined3d/surface_gdi.c b/dlls/wined3d/surface_gdi.c
index e1d082d..ddea727 100644
--- a/dlls/wined3d/surface_gdi.c
+++ b/dlls/wined3d/surface_gdi.c
@@ -196,6 +196,17 @@ IWineGDISurfaceImpl_LockRect(IWineD3DSur
TRACE("Lock Rect (%p) = l %ld, t %ld, r %ld, b %ld\n",
pRect, pRect->left, pRect->top, pRect->right, pRect->bottom);
+ if ((pRect->top < 0) ||
+ (pRect->left < 0) ||
+ (pRect->left >= pRect->right) ||
+ (pRect->top >= pRect->bottom) ||
+ (pRect->right > This->currentDesc.Width) ||
+ (pRect->bottom > This->currentDesc.Height))
+ {
+ WARN(" Invalid values in pRect !!!\n");
+ return D3DERR_INVALIDCALL;
+ }
+
if (This->resource.format == WINED3DFMT_DXT1)
{
/* DXT1 is half byte per pixel */
More information about the wine-cvs
mailing list