From f4205ad71f6705623691ea238e4f18773b623a7f Mon Sep 17 00:00:00 2001 From: Crestez Leonard Date: Tue, 21 Dec 2004 14:47:35 +0000 Subject: [PATCH] Check for malformed source rect in DIB_DirectDrawSurfact_BltFast, and return DDERR_INVALID_RECT. --- dlls/ddraw/dsurface/dib.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/dlls/ddraw/dsurface/dib.c b/dlls/ddraw/dsurface/dib.c index c01850bf816..cf23e0ba17a 100644 --- a/dlls/ddraw/dsurface/dib.c +++ b/dlls/ddraw/dsurface/dib.c @@ -999,6 +999,16 @@ DIB_DirectDrawSurface_BltFast(LPDIRECTDRAWSURFACE7 iface, DWORD dstx, rsrc->bottom = sdesc.dwHeight; } + /* Check source rect for validity. Copied from normal Blt. Fixes Baldur's Gate.*/ + if ((rsrc->bottom > sdesc.dwHeight) || (rsrc->bottom < 0) || + (rsrc->top > sdesc.dwHeight) || (rsrc->top < 0) || + (rsrc->left > sdesc.dwWidth) || (rsrc->left < 0) || + (rsrc->right > sdesc.dwWidth) || (rsrc->right < 0) || + (rsrc->right < rsrc->left) || (rsrc->bottom < rsrc->top)) { + WARN("Application gave us bad source rectangle for BltFast.\n"); + return DDERR_INVALIDRECT; + } + h=rsrc->bottom-rsrc->top; if (h>ddesc.dwHeight-dsty) h=ddesc.dwHeight-dsty; if (h>sdesc.dwHeight-rsrc->top) h=sdesc.dwHeight-rsrc->top;