https://bugs.winehq.org/show_bug.cgi?id=57300 Fabian Maurer <dark.shadow4(a)web.de> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |http://ftp.vector.co.jp/34/ | |19/1946/Knight050.lzh Keywords| |download, regression Regression SHA1| |aeb68e5df4b340d75366bb19d55 | |75a70a121e3cb --- Comment #1 from Fabian Maurer <dark.shadow4(a)web.de> --- Bisected to commit aeb68e5df4b340d75366bb19d5575a70a121e3cb Author: Elizabeth Figura <zfigura(a)codeweavers.com> Date: Wed Nov 15 11:14:22 2023 -0600 wined3d: Feed WINED3D_TSS_CONSTANT through a push constant buffer. The issue is caused by moving "struct list changed_lights;" to the top of the struct. Moving it back down makes it work again. The issue is an overflow inside d3d_device2_SwapTextureHandles
device->handle_table.entries[h2].object = surf1;
This writes a value into changed_lights, which it shouldn't. The entry table has size 64:
if (!ddraw_handle_table_init(&device->handle_table, 64))
The surf1 value is 68 though, so it is out of bounds. Not quite sure how to best fix. Is it allowed to have more than 64 values? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.