ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

wined3d: Avoid potential out-of-bounds memory access in surface_cpu_blt_colour_fill(). 

Draw rects are derived from the current viewport. It is possible to produce a
clear operation with a draw rect which lies completely outside of one of render
targets in D3D9.

It seems that we never use the CPU blitter for D3D9 render target clears, so it
might not be a problem in practice.

Signed-off-by: Józef Kucia <jkucia@codeweavers.com>
Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Józef Kucia 2019-01-16 15:29:34 +01:00 committed by Alexandre Julliard
parent 25ced03068
commit e37b9c74f0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dlls/wined3d/surface.c
View File

@ -2970,8 +2970,8 @@ static void surface_cpu_blt_colour_fill(struct wined3d_rendertarget_view *view,
c = wined3d_format_convert_from_float(view->format, colour);
bpp = view->format->byte_count;
w = min(box->right, view->width) - box->left;
h = min(box->bottom, view->height) - box->top;
w = min(box->right, view->width) - min(box->left, view->width);
h = min(box->bottom, view->height) - min(box->top, view->height);
texture = texture_from_resource(view->resource);
map_binding = texture->resource.map_binding;