ddraw: Better validation of IDirectDrawSurface::BltFast parameters.

Iain Arnell iarnell at gmail.com
Fri Jun 18 08:52:53 CDT 2010


fixes #23238 -  Repton 3: crashes when viewing map.
---
 dlls/ddraw/surface.c        |    6 ++++--
 dlls/ddraw/tests/dsurface.c |    4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/dlls/ddraw/surface.c b/dlls/ddraw/surface.c
index bfe83a4..e380dcb 100644
--- a/dlls/ddraw/surface.c
+++ b/dlls/ddraw/surface.c
@@ -2093,7 +2093,8 @@ IDirectDrawSurfaceImpl_BltFast(IDirectDrawSurface7 *iface,
             return DDERR_INVALIDRECT;
         }
         if(dstx + rsrc->right - rsrc->left > This->surface_desc.dwWidth ||
-           dsty + rsrc->bottom - rsrc->top > This->surface_desc.dwHeight)
+           dsty + rsrc->bottom - rsrc->top > This->surface_desc.dwHeight ||
+           (dstx | dsty) & (1<<(sizeof(DWORD)*8-1)) /* dstx or dsty negative */ )
         {
             WARN("Destination area out of bounds, returning DDERR_INVALIDRECT\n");
             return DDERR_INVALIDRECT;
@@ -2102,7 +2103,8 @@ IDirectDrawSurfaceImpl_BltFast(IDirectDrawSurface7 *iface,
     else
     {
         if(dstx + src->surface_desc.dwWidth > This->surface_desc.dwWidth ||
-           dsty + src->surface_desc.dwHeight > This->surface_desc.dwHeight)
+           dsty + src->surface_desc.dwHeight > This->surface_desc.dwHeight ||
+           (dstx | dsty) & (1<<(sizeof(DWORD)*8-1)) /* dstx or dsty negative */ )
         {
             WARN("Destination area out of bounds, returning DDERR_INVALIDRECT\n");
             return DDERR_INVALIDRECT;
diff --git a/dlls/ddraw/tests/dsurface.c b/dlls/ddraw/tests/dsurface.c
index bfd5eae..92dcb65 100644
--- a/dlls/ddraw/tests/dsurface.c
+++ b/dlls/ddraw/tests/dsurface.c
@@ -2537,6 +2537,10 @@ static void BltParamTest(void)
     ok(hr == DDERR_INVALIDRECT, "BltFast with a rectangle resulting in an off-surface write returned %08x\n", hr);
     hr = IDirectDrawSurface_BltFast(surface1, 90, 90, surface2, NULL, 0);
     ok(hr == DDERR_INVALIDRECT, "BltFast with a rectangle resulting in an off-surface write returned %08x\n", hr);
+    hr = IDirectDrawSurface_BltFast(surface1, -10, 0, surface2, NULL, 0);
+    ok(hr == DDERR_INVALIDRECT, "BltFast with a rectangle resulting in an off-surface write returned %08x\n", hr);
+    hr = IDirectDrawSurface_BltFast(surface1, 0, -10, surface2, NULL, 0);
+    ok(hr == DDERR_INVALIDRECT, "BltFast with a rectangle resulting in an off-surface write returned %08x\n", hr);
     hr = IDirectDrawSurface_BltFast(surface2, 0, 0, surface1, &invalid1, 0);
     ok(hr == DDERR_INVALIDRECT, "BltFast with invalid rectangle 1 returned %08x\n", hr);
     hr = IDirectDrawSurface_BltFast(surface2, 0, 0, surface1, &invalid2, 0);
-- 
1.7.0.1




More information about the wine-patches mailing list