Henri Verbeet : wined3d: Validate vertex shader input signature register indices (AFL).

[Alexandre Julliard]

Module: wine
Branch: master
Commit: cc16e0d2de47bc6a34039f6cc8d261d94241edf3
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=cc16e0d2de47bc6a34039f6cc8d261d94241edf3

Author: Henri Verbeet <hverbeet at codeweavers.com>
Date:   Tue Jul 25 14:26:00 2017 +0200

wined3d: Validate vertex shader input signature register indices (AFL).

Signed-off-by: Henri Verbeet <hverbeet at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/wined3d/shader.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dlls/wined3d/shader.c b/dlls/wined3d/shader.c
index d9504ef..8ed2cb9 100644
--- a/dlls/wined3d/shader.c
+++ b/dlls/wined3d/shader.c
@@ -1684,14 +1684,22 @@ static HRESULT shader_get_registers_used(struct wined3d_shader *shader, const st
     {
         for (i = 0; i < input_signature->element_count; ++i)
         {
-            reg_maps->input_registers |= 1u << input_signature->elements[i].register_idx;
-            if (shader_version.type == WINED3D_SHADER_TYPE_PIXEL)
+            if (shader_version.type == WINED3D_SHADER_TYPE_VERTEX)
+            {
+                if (input_signature->elements[i].register_idx >= ARRAY_SIZE(shader->u.vs.attributes))
+                {
+                    WARN("Invalid input signature register index %u.\n", input_signature->elements[i].register_idx);
+                    return WINED3DERR_INVALIDCALL;
+                }
+            }
+            else if (shader_version.type == WINED3D_SHADER_TYPE_PIXEL)
             {
                 if (input_signature->elements[i].sysval_semantic == WINED3D_SV_POSITION)
                     reg_maps->vpos = 1;
                 else if (input_signature->elements[i].sysval_semantic == WINED3D_SV_IS_FRONT_FACE)
                     reg_maps->usesfacing = 1;
             }
+            reg_maps->input_registers |= 1u << input_signature->elements[i].register_idx;
         }
     }
     else if (!input_signature->elements && reg_maps->input_registers)