[dx89] CopyRects heap overwrite
Jason Edmeades
us at the-edmeades.demon.co.uk
Wed Oct 29 18:19:35 CST 2003
Changelog
CopyRects (per rect) copied one too many lines, trashing the heap.
Also tidies up scissor test from previous patch
Jason
-------------- next part --------------
diff -u3 dlls/d3d8/dx88/device.c dlls/d3d8/device.c
--- dlls/d3d8/dx88/device.c 2003-10-28 22:03:07.000000000 +0000
+++ dlls/d3d8/device.c 2003-10-29 00:12:00.000000000 +0000
@@ -1056,9 +1056,9 @@
TRACE("Locked src and dst\n");
/* Find where to start */
- for (j = 0; j < (r->bottom - r->top); j++) {
+ for (j = 0; j < (r->bottom - r->top - 1); j++) {
memcpy((char*) lrDst.pBits + (j * lrDst.Pitch), (char*) lrSrc.pBits + (j * lrSrc.Pitch), copyperline);
- }
+ }
IDirect3DSurface8Impl_UnlockRect((LPDIRECT3DSURFACE8) src);
rc = IDirect3DSurface8Impl_UnlockRect((LPDIRECT3DSURFACE8) dst);
@@ -1352,8 +1352,6 @@
glEnable(GL_SCISSOR_TEST);
checkGLcall("glEnable GL_SCISSOR_TEST");
if (Count > 0 && pRects) {
- glEnable(GL_SCISSOR_TEST);
- checkGLcall("glEnable GL_SCISSOR_TEST");
curRect = pRects;
} else {
curRect = NULL;
@@ -1430,10 +1428,8 @@
old_color_clear_value[3]);
}
- if (Count > 0 && pRects) {
- glDisable(GL_SCISSOR_TEST);
- checkGLcall("glDisable");
- }
+ glDisable(GL_SCISSOR_TEST);
+ checkGLcall("glDisable");
LEAVE_GL();
return D3D_OK;
More information about the wine-patches
mailing list