Henri Verbeet : wined3d: Validate the sub-resource index in wined3d_rendertarget_view_init().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 33d49ecd76e36053138552008f2389575698c5d3
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=33d49ecd76e36053138552008f...

Author: Henri Verbeet <hverbeet(a)codeweavers.com>
Date:   Tue Mar 29 16:45:34 2016 +0200

wined3d: Validate the sub-resource index in wined3d_rendertarget_view_init().

Signed-off-by: Henri Verbeet <hverbeet(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/wined3d/view.c            | 36 +++++++++++++++++++++---------------
 dlls/wined3d/wined3d_private.h |  5 +----
 2 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/dlls/wined3d/view.c b/dlls/wined3d/view.c
index 8d4f7fd..29b370f 100644
--- a/dlls/wined3d/view.c
+++ b/dlls/wined3d/view.c
@@ -60,18 +60,16 @@ void * CDECL wined3d_rendertarget_view_get_parent(const struct wined3d_rendertar
 
 void * CDECL wined3d_rendertarget_view_get_sub_resource_parent(const struct wined3d_rendertarget_view *view)
 {
-    struct wined3d_resource *sub_resource;
+    struct wined3d_texture *texture;
 
     TRACE("view %p.\n", view);
 
     if (view->resource->type == WINED3D_RTYPE_BUFFER)
         return wined3d_buffer_get_parent(buffer_from_resource(view->resource));
 
-    if (!(sub_resource = wined3d_texture_get_sub_resource(wined3d_texture_from_resource(view->resource),
-            view->sub_resource_idx)))
-        return NULL;
+    texture = wined3d_texture_from_resource(view->resource);
 
-    return wined3d_resource_get_parent(sub_resource);
+    return wined3d_resource_get_parent(texture->sub_resources[view->sub_resource_idx].resource);
 }
 
 void CDECL wined3d_rendertarget_view_set_parent(struct wined3d_rendertarget_view *view, void *parent)
@@ -88,15 +86,13 @@ struct wined3d_resource * CDECL wined3d_rendertarget_view_get_resource(const str
     return view->resource;
 }
 
-static void wined3d_rendertarget_view_init(struct wined3d_rendertarget_view *view,
+static HRESULT wined3d_rendertarget_view_init(struct wined3d_rendertarget_view *view,
         const struct wined3d_rendertarget_view_desc *desc, struct wined3d_resource *resource,
         void *parent, const struct wined3d_parent_ops *parent_ops)
 {
     const struct wined3d_gl_info *gl_info = &resource->device->adapter->gl_info;
 
     view->refcount = 1;
-    view->resource = resource;
-    wined3d_resource_incref(resource);
     view->parent = parent;
     view->parent_ops = parent_ops;
 
@@ -113,16 +109,20 @@ static void wined3d_rendertarget_view_init(struct wined3d_rendertarget_view *vie
     else
     {
         struct wined3d_texture *texture = wined3d_texture_from_resource(resource);
-        struct wined3d_resource *sub_resource;
 
+        if (desc->u.texture.level_idx >= texture->level_count
+                || desc->u.texture.layer_idx >= texture->layer_count
+                || desc->u.texture.layer_count > texture->layer_count - desc->u.texture.layer_idx)
+            return WINED3DERR_INVALIDCALL;
         view->sub_resource_idx = desc->u.texture.layer_idx * texture->level_count + desc->u.texture.level_idx;
-        sub_resource = wined3d_texture_get_sub_resource(texture, view->sub_resource_idx);
-
         view->buffer_offset = 0;
-        view->width = sub_resource->width;
-        view->height = sub_resource->height;
+        view->width = wined3d_texture_get_level_width(texture, desc->u.texture.level_idx);
+        view->height = wined3d_texture_get_level_height(texture, desc->u.texture.level_idx);
         view->depth = desc->u.texture.layer_count;
     }
+    wined3d_resource_incref(view->resource = resource);
+
+    return WINED3D_OK;
 }
 
 HRESULT CDECL wined3d_rendertarget_view_create(const struct wined3d_rendertarget_view_desc *desc,
@@ -130,6 +130,7 @@ HRESULT CDECL wined3d_rendertarget_view_create(const struct wined3d_rendertarget
         struct wined3d_rendertarget_view **view)
 {
     struct wined3d_rendertarget_view *object;
+    HRESULT hr;
 
     TRACE("desc %p, resource %p, parent %p, parent_ops %p, view %p.\n",
             desc, resource, parent, parent_ops, view);
@@ -137,12 +138,17 @@ HRESULT CDECL wined3d_rendertarget_view_create(const struct wined3d_rendertarget
     if (!(object = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*object))))
         return E_OUTOFMEMORY;
 
-    wined3d_rendertarget_view_init(object, desc, resource, parent, parent_ops);
+    if (FAILED(hr = wined3d_rendertarget_view_init(object, desc, resource, parent, parent_ops)))
+    {
+        HeapFree(GetProcessHeap(), 0, object);
+        WARN("Failed to initialise view, hr %#x.\n", hr);
+        return hr;
+    }
 
     TRACE("Created render target view %p.\n", object);
     *view = object;
 
-    return WINED3D_OK;
+    return hr;
 }
 
 HRESULT CDECL wined3d_rendertarget_view_create_from_sub_resource(struct wined3d_texture *texture,
diff --git a/dlls/wined3d/wined3d_private.h b/dlls/wined3d/wined3d_private.h
index 5beea4a..a9ad85c 100644
--- a/dlls/wined3d/wined3d_private.h
+++ b/dlls/wined3d/wined3d_private.h
@@ -2958,17 +2958,14 @@ struct wined3d_rendertarget_view
 static inline struct wined3d_surface *wined3d_rendertarget_view_get_surface(
         const struct wined3d_rendertarget_view *view)
 {
-    struct wined3d_resource *resource;
     struct wined3d_texture *texture;
 
     if (!view || view->resource->type != WINED3D_RTYPE_TEXTURE_2D)
         return NULL;
 
     texture = wined3d_texture_from_resource(view->resource);
-    if (!(resource = wined3d_texture_get_sub_resource(texture, view->sub_resource_idx)))
-        return NULL;
 
-    return surface_from_resource(resource);
+    return texture->sub_resources[view->sub_resource_idx].u.surface;
 }
 
 struct wined3d_shader_resource_view