ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

d3d10: Validate offsets and sizes in parse_dxbc() (AFL). 

Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Henri Verbeet 2016-05-24 19:46:42 +02:00 committed by Alexandre Julliard
parent e5a4da38eb
commit 994c5618b1
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
dlls/d3d10/d3d10_private.h
View File

@ -294,6 +294,11 @@ static inline void write_dword(char **ptr, DWORD d)
*ptr += sizeof(d); *ptr += sizeof(d);
} }
static inline BOOL require_space(size_t offset, size_t size, size_t data_size)
{
return data_size - offset >= size;
}
void skip_dword_unknown(const char *location, const char **ptr, unsigned int count) DECLSPEC_HIDDEN; void skip_dword_unknown(const char *location, const char **ptr, unsigned int count) DECLSPEC_HIDDEN;
void write_dword_unknown(char **ptr, DWORD d) DECLSPEC_HIDDEN; void write_dword_unknown(char **ptr, DWORD d) DECLSPEC_HIDDEN;

12
dlls/d3d10/utils.c
View File

@ -217,11 +217,23 @@ HRESULT parse_dxbc(const char *data, SIZE_T data_size,
read_dword(&ptr, &chunk_offset); read_dword(&ptr, &chunk_offset);
TRACE("chunk %u at offset %#x\n", i, chunk_offset); TRACE("chunk %u at offset %#x\n", i, chunk_offset);
if (chunk_offset >= data_size || !require_space(chunk_offset, 2 * sizeof(DWORD), data_size))
{
WARN("Invalid chunk offset %#x (data size %#lx).\n", chunk_offset, data_size);
return E_FAIL;
}
chunk_ptr = data + chunk_offset; chunk_ptr = data + chunk_offset;
read_dword(&chunk_ptr, &chunk_tag); read_dword(&chunk_ptr, &chunk_tag);
read_dword(&chunk_ptr, &chunk_size); read_dword(&chunk_ptr, &chunk_size);
if (!require_space(chunk_ptr - data, chunk_size, data_size))
{
WARN("Invalid chunk size %#x (data size %#lx, chunk offset %#x).\n", chunk_size, data_size, chunk_offset);
return E_FAIL;
}
hr = chunk_handler(chunk_ptr, chunk_size, chunk_tag, ctx); hr = chunk_handler(chunk_ptr, chunk_size, chunk_tag, ctx);
if (FAILED(hr)) break; if (FAILED(hr)) break;
} }