Henri Verbeet : wined3d: Validate WINED3DSPR_TEXCRDOUT indices in shader_get_registers_used() (AFL ).

[Alexandre Julliard]

Module: wine
Branch: master
Commit: e27f31d18c47e53c5cb6117f733a623d0e5f55eb
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=e27f31d18c47e53c5cb6117f733a623d0e5f55eb

Author: Henri Verbeet <hverbeet at codeweavers.com>
Date:   Tue Feb 21 00:40:07 2017 +0100

wined3d: Validate WINED3DSPR_TEXCRDOUT indices in shader_get_registers_used() (AFL).

Signed-off-by: Henri Verbeet <hverbeet at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/wined3d/shader.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/dlls/wined3d/shader.c b/dlls/wined3d/shader.c
index 6278392..0bf8e26 100644
--- a/dlls/wined3d/shader.c
+++ b/dlls/wined3d/shader.c
@@ -1195,9 +1195,19 @@ static HRESULT shader_get_registers_used(struct wined3d_shader *shader, const st
                         case WINED3DSPR_TEXCRDOUT:
                             if (shader_version.major >= 3)
                             {
+                                if (idx >= ARRAY_SIZE(reg_maps->u.output_registers_mask))
+                                {
+                                    WARN("Invalid output register index %u.\n", idx);
+                                    break;
+                                }
                                 reg_maps->u.output_registers_mask[idx] |= ins.dst[i].write_mask;
                                 break;
                             }
+                            if (idx >= ARRAY_SIZE(reg_maps->u.texcoord_mask))
+                            {
+                                WARN("Invalid texcoord index %u.\n", idx);
+                                break;
+                            }
                             reg_maps->u.texcoord_mask[idx] |= ins.dst[i].write_mask;
                             if (reg_maps->output_registers & (1u << idx))
                             {