[PATCH 4/5] d3drm: Strengthen check for valid viewport dimensions.

[Jeff Smith]

Signed-off-by: Jeff Smith <whydoubt at gmail.com>
---
 dlls/d3drm/tests/d3drm.c | 32 ++++++++++++++++++++++++++++++++
 dlls/d3drm/viewport.c    | 16 ++++++++++++++--
 2 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/dlls/d3drm/tests/d3drm.c b/dlls/d3drm/tests/d3drm.c
index d6f8322813..7317a316fa 100644
--- a/dlls/d3drm/tests/d3drm.c
+++ b/dlls/d3drm/tests/d3drm.c
@@ -1921,6 +1921,14 @@ static void test_Viewport(void)
     ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
     ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
     viewport = (IDirect3DRMViewport *)0xdeadbeef;
+    hr = IDirect3DRM_CreateViewport(d3drm1, device1, frame, rc.left + 1, rc.top, rc.right, rc.bottom, &viewport);
+    ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
+    ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
+    viewport = (IDirect3DRMViewport *)0xdeadbeef;
+    hr = IDirect3DRM_CreateViewport(d3drm1, device1, frame, rc.left, rc.top + 1, rc.right, rc.bottom, &viewport);
+    ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
+    ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
+    viewport = (IDirect3DRMViewport *)0xdeadbeef;
     hr = IDirect3DRM_CreateViewport(d3drm1, device1, frame, rc.left, rc.top, rc.right + 1, rc.bottom + 1, &viewport);
     ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
     ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
@@ -1944,6 +1952,14 @@ static void test_Viewport(void)
     ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
     ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
     viewport = (IDirect3DRMViewport *)0xdeadbeef;
+    hr = IDirect3DRM2_CreateViewport(d3drm2, device1, frame, rc.left + 1, rc.top, rc.right, rc.bottom, &viewport);
+    ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
+    ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
+    viewport = (IDirect3DRMViewport *)0xdeadbeef;
+    hr = IDirect3DRM2_CreateViewport(d3drm2, device1, frame, rc.left, rc.top + 1, rc.right, rc.bottom, &viewport);
+    ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
+    ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
+    viewport = (IDirect3DRMViewport *)0xdeadbeef;
     hr = IDirect3DRM2_CreateViewport(d3drm2, device1, frame, rc.left, rc.top, rc.right + 1, rc.bottom + 1, &viewport);
     ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
     ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport);
@@ -1967,6 +1983,14 @@ static void test_Viewport(void)
     ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
     ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2);
     viewport2 = (IDirect3DRMViewport2 *)0xdeadbeef;
+    hr = IDirect3DRM3_CreateViewport(d3drm3, device3, frame3, rc.left + 1, rc.top, rc.right, rc.bottom, &viewport2);
+    ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
+    ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2);
+    viewport2 = (IDirect3DRMViewport2 *)0xdeadbeef;
+    hr = IDirect3DRM3_CreateViewport(d3drm3, device3, frame3, rc.left, rc.top + 1, rc.right, rc.bottom, &viewport2);
+    ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
+    ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2);
+    viewport2 = (IDirect3DRMViewport2 *)0xdeadbeef;
     hr = IDirect3DRM3_CreateViewport(d3drm3, device3, frame3, rc.left, rc.top, rc.right + 1, rc.bottom + 1, &viewport2);
     ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr);
     ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2);
@@ -2191,6 +2215,10 @@ static void test_Viewport(void)
     ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
     hr = IDirect3DRMViewport_Init(viewport, device1, frame, rc.left, rc.top, rc.right, rc.bottom + 1);
     ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
+    hr = IDirect3DRMViewport_Init(viewport, device1, frame, rc.left + 1, rc.top, rc.right, rc.bottom);
+    ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
+    hr = IDirect3DRMViewport_Init(viewport, device1, frame, rc.left, rc.top + 1, rc.right, rc.bottom);
+    ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
 
     device_ref = get_refcount((IUnknown *)device1);
     frame_ref = get_refcount((IUnknown *)frame);
@@ -2409,6 +2437,10 @@ static void test_Viewport(void)
     ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
     hr = IDirect3DRMViewport2_Init(viewport2, device3, frame3, rc.left, rc.top, rc.right, rc.bottom + 1);
     ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
+    hr = IDirect3DRMViewport2_Init(viewport2, device3, frame3, rc.left + 1, rc.top, rc.right, rc.bottom);
+    ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
+    hr = IDirect3DRMViewport2_Init(viewport2, device3, frame3, rc.left, rc.top + 1, rc.right, rc.bottom);
+    ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr);
 
     device_ref = get_refcount((IUnknown *)device3);
     frame_ref2 = get_refcount((IUnknown *)frame3);
diff --git a/dlls/d3drm/viewport.c b/dlls/d3drm/viewport.c
index 25a83e6e89..24fa198de5 100644
--- a/dlls/d3drm/viewport.c
+++ b/dlls/d3drm/viewport.c
@@ -300,6 +300,19 @@ static HRESULT WINAPI d3drm_viewport1_GetClassName(IDirect3DRMViewport *iface, D
     return d3drm_viewport2_GetClassName(&viewport->IDirect3DRMViewport2_iface, size, name);
 }
 
+static HRESULT d3drm_viewport_check_device_dims(struct d3drm_device *device,
+        DWORD x, DWORD y, DWORD width, DWORD height)
+{
+    if (x > device->width || y > device->height
+            || width > device->width || height > device->height
+            || x + width > device->width || y + height > device->height)
+    {
+        return D3DRMERR_BADVALUE;
+    }
+
+    return D3D_OK;
+}
+
 static HRESULT WINAPI d3drm_viewport2_Init(IDirect3DRMViewport2 *iface, IDirect3DRMDevice3 *device,
         IDirect3DRMFrame3 *camera, DWORD x, DWORD y, DWORD width, DWORD height)
 {
@@ -317,8 +330,7 @@ static HRESULT WINAPI d3drm_viewport2_Init(IDirect3DRMViewport2 *iface, IDirect3
             iface, device, camera, x, y, width, height);
 
     if (!device_obj || !camera
-            || width > device_obj->width
-            || height > device_obj->height)
+            || FAILED(d3drm_viewport_check_device_dims(device_obj, x, y, width, height)))
     {
         return D3DRMERR_BADOBJECT;
     }
-- 
2.21.0