[PATCH 1/2] d3drm: Also validate face indices against the vertex count in load_mesh_data() (Valgrind).

[Henri Verbeet]

---
 dlls/d3drm/meshbuilder.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dlls/d3drm/meshbuilder.c b/dlls/d3drm/meshbuilder.c
index c24d9dc..8bd5131 100644
--- a/dlls/d3drm/meshbuilder.c
+++ b/dlls/d3drm/meshbuilder.c
@@ -1368,7 +1368,10 @@ HRESULT load_mesh_data(IDirect3DRMMeshBuilder3 *iface, IDirectXFileData *pData,
         if (!This->nb_normals)
         {
             /* Compute face normal */
-            if (nb_face_indexes > 2)
+            if (nb_face_indexes > 2
+                    && faces_vertex_idx_ptr[0] < This->nb_vertices
+                    && faces_vertex_idx_ptr[1] < This->nb_vertices
+                    && faces_vertex_idx_ptr[2] < This->nb_vertices)
             {
                 D3DVECTOR a, b;
 
-- 
1.7.10.4