Alex Henrie : ddraw: Validate the "surface" pointer before creating the surface in CreateSurface().

[Alexandre Julliard]

Module: wine
Branch: stable
Commit: d09cb43d6ae46cba5bbdb585f342eb788f81f802
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=d09cb43d6ae46cba5bbdb585f342eb788f81f802

Author: Alex Henrie <alexhenrie24 at gmail.com>
Date:   Thu Feb 16 15:12:15 2017 +0100

ddraw: Validate the "surface" pointer before creating the surface in CreateSurface().

And thereby avoid leaking the surface on the error path.

Signed-off-by: Henri Verbeet <hverbeet at codeweavers.com>
Signed-off-by: Alex Henrie <alexhenrie24 at gmail.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
(cherry picked from commit 062f1ae7524ef0049bbb8579bd6d03e6eca0be16)
Signed-off-by: Michael Stefaniuc <mstefani at winehq.org>

---

 dlls/ddraw/ddraw.c | 128 +++++++++++++++++++++++++++--------------------------
 1 file changed, 66 insertions(+), 62 deletions(-)

diff --git a/dlls/ddraw/ddraw.c b/dlls/ddraw/ddraw.c
index 10bba4e..9091a1d 100644
--- a/dlls/ddraw/ddraw.c
+++ b/dlls/ddraw/ddraw.c
@@ -2802,6 +2802,18 @@ static HRESULT WINAPI ddraw7_CreateSurface(IDirectDraw7 *iface, DDSURFACEDESC2 *
         return DDERR_INVALIDPARAMS;
     }
 
+    __TRY
+    {
+        *surface = NULL;
+    }
+    __EXCEPT_PAGE_FAULT
+    {
+        WARN("Surface pointer %p is invalid.\n", surface);
+        wined3d_mutex_unlock();
+        return DDERR_INVALIDPARAMS;
+    }
+    __ENDTRY;
+
     if(surface_desc->ddsCaps.dwCaps & (DDSCAPS_FRONTBUFFER | DDSCAPS_BACKBUFFER))
     {
         if (TRACE_ON(ddraw))
@@ -2817,23 +2829,12 @@ static HRESULT WINAPI ddraw7_CreateSurface(IDirectDraw7 *iface, DDSURFACEDESC2 *
 
     hr = ddraw_surface_create(ddraw, surface_desc, &impl, outer_unknown, 7);
     wined3d_mutex_unlock();
+    if (FAILED(hr))
+        return hr;
 
-    __TRY
-    {
-        if (FAILED(hr))
-        {
-            *surface = NULL;
-            break;
-        }
-        *surface = &impl->IDirectDrawSurface7_iface;
-        IDirectDraw7_AddRef(iface);
-        impl->ifaceToRelease = (IUnknown *)iface;
-    }
-    __EXCEPT_PAGE_FAULT
-    {
-        hr = E_INVALIDARG;
-    }
-    __ENDTRY;
+    *surface = &impl->IDirectDrawSurface7_iface;
+    IDirectDraw7_AddRef(iface);
+    impl->ifaceToRelease = (IUnknown *)iface;
 
     return hr;
 }
@@ -2864,6 +2865,18 @@ static HRESULT WINAPI ddraw4_CreateSurface(IDirectDraw4 *iface,
         return DDERR_INVALIDPARAMS;
     }
 
+    __TRY
+    {
+        *surface = NULL;
+    }
+    __EXCEPT_PAGE_FAULT
+    {
+        WARN("Surface pointer %p is invalid.\n", surface);
+        wined3d_mutex_unlock();
+        return DDERR_INVALIDPARAMS;
+    }
+    __ENDTRY;
+
     if(surface_desc->ddsCaps.dwCaps & (DDSCAPS_FRONTBUFFER | DDSCAPS_BACKBUFFER))
     {
         if (TRACE_ON(ddraw))
@@ -2879,23 +2892,12 @@ static HRESULT WINAPI ddraw4_CreateSurface(IDirectDraw4 *iface,
 
     hr = ddraw_surface_create(ddraw, surface_desc, &impl, outer_unknown, 4);
     wined3d_mutex_unlock();
+    if (FAILED(hr))
+        return hr;
 
-    __TRY
-    {
-        if (FAILED(hr))
-        {
-            *surface = NULL;
-            break;
-        }
-        *surface = &impl->IDirectDrawSurface4_iface;
-        IDirectDraw4_AddRef(iface);
-        impl->ifaceToRelease = (IUnknown *)iface;
-    }
-    __EXCEPT_PAGE_FAULT
-    {
-        hr = E_INVALIDARG;
-    }
-    __ENDTRY;
+    *surface = &impl->IDirectDrawSurface4_iface;
+    IDirectDraw4_AddRef(iface);
+    impl->ifaceToRelease = (IUnknown *)iface;
 
     return hr;
 }
@@ -2927,6 +2929,18 @@ static HRESULT WINAPI ddraw2_CreateSurface(IDirectDraw2 *iface,
         return DDERR_INVALIDPARAMS;
     }
 
+    __TRY
+    {
+        *surface = NULL;
+    }
+    __EXCEPT_PAGE_FAULT
+    {
+        WARN("Surface pointer %p is invalid.\n", surface);
+        wined3d_mutex_unlock();
+        return DDERR_INVALIDPARAMS;
+    }
+    __ENDTRY;
+
     DDSD_to_DDSD2(surface_desc, &surface_desc2);
     if(surface_desc->ddsCaps.dwCaps & (DDSCAPS_FRONTBUFFER | DDSCAPS_BACKBUFFER))
     {
@@ -2943,22 +2957,11 @@ static HRESULT WINAPI ddraw2_CreateSurface(IDirectDraw2 *iface,
 
     hr = ddraw_surface_create(ddraw, &surface_desc2, &impl, outer_unknown, 2);
     wined3d_mutex_unlock();
+    if (FAILED(hr))
+        return hr;
 
-    __TRY
-    {
-        if (FAILED(hr))
-        {
-            *surface = NULL;
-            break;
-        }
-        *surface = &impl->IDirectDrawSurface_iface;
-        impl->ifaceToRelease = NULL;
-    }
-    __EXCEPT_PAGE_FAULT
-    {
-        hr = E_INVALIDARG;
-    }
-    __ENDTRY;
+    *surface = &impl->IDirectDrawSurface_iface;
+    impl->ifaceToRelease = NULL;
 
     return hr;
 }
@@ -2990,6 +2993,18 @@ static HRESULT WINAPI ddraw1_CreateSurface(IDirectDraw *iface,
         return DDERR_INVALIDPARAMS;
     }
 
+    __TRY
+    {
+        *surface = NULL;
+    }
+    __EXCEPT_PAGE_FAULT
+    {
+        WARN("Surface pointer %p is invalid.\n", surface);
+        wined3d_mutex_unlock();
+        return DDERR_INVALIDPARAMS;
+    }
+    __ENDTRY;
+
     if ((surface_desc->ddsCaps.dwCaps & (DDSCAPS_PRIMARYSURFACE | DDSCAPS_BACKBUFFER))
             == (DDSCAPS_PRIMARYSURFACE | DDSCAPS_BACKBUFFER)
             || (surface_desc->ddsCaps.dwCaps & (DDSCAPS_FLIP | DDSCAPS_FRONTBUFFER))
@@ -3003,22 +3018,11 @@ static HRESULT WINAPI ddraw1_CreateSurface(IDirectDraw *iface,
     DDSD_to_DDSD2(surface_desc, &surface_desc2);
     hr = ddraw_surface_create(ddraw, &surface_desc2, &impl, outer_unknown, 1);
     wined3d_mutex_unlock();
+    if (FAILED(hr))
+        return hr;
 
-    __TRY
-    {
-        if (FAILED(hr))
-        {
-            *surface = NULL;
-            break;
-        }
-        *surface = &impl->IDirectDrawSurface_iface;
-        impl->ifaceToRelease = NULL;
-    }
-    __EXCEPT_PAGE_FAULT
-    {
-        hr = E_INVALIDARG;
-    }
-    __ENDTRY;
+    *surface = &impl->IDirectDrawSurface_iface;
+    impl->ifaceToRelease = NULL;
 
     return hr;
 }