Zebediah Figura : d3d9: Validate the stream index in d3d9_device_SetStreamSource().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: a3b36a34a6f140c7a3ea41db106b2c38a98f099e
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=a3b36a34a6f140c7a3ea41db106b2c38a98f099e

Author: Zebediah Figura <z.figura12 at gmail.com>
Date:   Wed Feb 19 09:53:51 2020 -0600

d3d9: Validate the stream index in d3d9_device_SetStreamSource().

Signed-off-by: Zebediah Figura <z.figura12 at gmail.com>
Signed-off-by: Henri Verbeet <hverbeet at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/d3d9/device.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/dlls/d3d9/device.c b/dlls/d3d9/device.c
index 53e27adf05..8d85a43523 100644
--- a/dlls/d3d9/device.c
+++ b/dlls/d3d9/device.c
@@ -3669,16 +3669,25 @@ static HRESULT WINAPI d3d9_device_SetStreamSource(IDirect3DDevice9Ex *iface,
 {
     struct d3d9_device *device = impl_from_IDirect3DDevice9Ex(iface);
     struct d3d9_vertexbuffer *buffer_impl = unsafe_impl_from_IDirect3DVertexBuffer9(buffer);
+    const struct wined3d_stateblock_state *state;
     struct wined3d_buffer *wined3d_buffer;
     HRESULT hr;
 
     TRACE("iface %p, stream_idx %u, buffer %p, offset %u, stride %u.\n",
             iface, stream_idx, buffer, offset, stride);
 
+    if (stream_idx >= ARRAY_SIZE(state->streams))
+    {
+        WARN("Stream index %u out of range.\n", stream_idx);
+        return WINED3DERR_INVALIDCALL;
+    }
+
     wined3d_mutex_lock();
     if (!buffer_impl)
     {
-        const struct wined3d_stream_state *stream = &wined3d_stateblock_get_state(device->state)->streams[stream_idx];
+        const struct wined3d_stream_state *stream;
+        state = wined3d_stateblock_get_state(device->state);
+        stream = &state->streams[stream_idx];
         wined3d_buffer = stream->buffer;
         offset = stream->offset;
         stride = stream->stride;