ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

d3d9: Fix crash in d3d9_vertexbuffer_Release(). 

If there is no draw buffer then buffer pointer gets freed in
wined3d_buffer_decref() via d3d9_vertexbuffer_wined3d_parent_ops
and consequent check for buffer->draw_buffer results in freed
memory access.

Signed-off-by: Paul Gofman <gofmanp@gmail.com>
Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Paul Gofman 2018-12-18 19:57:22 +03:00 committed by Alexandre Julliard
parent cc743f8e6c
commit e6c6be1cf7
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
dlls/d3d9/buffer.c
View File

@ -76,12 +76,13 @@ static ULONG WINAPI d3d9_vertexbuffer_Release(IDirect3DVertexBuffer9 *iface)
if (!refcount) if (!refcount)
{ {
struct wined3d_buffer *draw_buffer = buffer->draw_buffer;
IDirect3DDevice9Ex *device = buffer->parent_device; IDirect3DDevice9Ex *device = buffer->parent_device;
wined3d_mutex_lock(); wined3d_mutex_lock();
wined3d_buffer_decref(buffer->wined3d_buffer); wined3d_buffer_decref(buffer->wined3d_buffer);
if (buffer->draw_buffer) if (draw_buffer)
wined3d_buffer_decref(buffer->draw_buffer); wined3d_buffer_decref(draw_buffer);
wined3d_mutex_unlock(); wined3d_mutex_unlock();
/* Release the device last, as it may cause the device to be destroyed. */ /* Release the device last, as it may cause the device to be destroyed. */