Jeff Zaroyko : dsound: Check for invalid parameter when unlocking secondary buffers.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: e55a702928b9efb9f51ed7817dc76d41e53fc9fa
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=e55a702928b9efb9f51ed7817d...

Author: Jeff Zaroyko <jeffz(a)jeffz.name>
Date:   Wed Sep  3 07:08:21 2008 +1000

dsound: Check for invalid parameter when unlocking secondary buffers.

---

 dlls/dsound/buffer.c     |    7 ++++++-
 dlls/dsound/tests/ds3d.c |    3 +++
 2 files changed, 9 insertions(+), 1 deletions(-)

diff --git a/dlls/dsound/buffer.c b/dlls/dsound/buffer.c
index 480e8a1..6659a47 100644
--- a/dlls/dsound/buffer.c
+++ b/dlls/dsound/buffer.c
@@ -735,7 +735,12 @@ static HRESULT WINAPI IDirectSoundBufferImpl_Unlock(
 		{
 			RtlAcquireResourceShared(&iter->lock, TRUE);
 			if (x1)
-				DSOUND_MixToTemporary(iter, (DWORD_PTR)p1 - (DWORD_PTR)iter->buffer->memory, x1, FALSE);
+                        {
+			    if(x1 + (DWORD_PTR)p1 - (DWORD_PTR)iter->buffer->memory > iter->buflen)
+			      hres = DSERR_INVALIDPARAM;
+			    else
+			      DSOUND_MixToTemporary(iter, (DWORD_PTR)p1 - (DWORD_PTR)iter->buffer->memory, x1, FALSE);
+                        }
 			if (x2)
 				DSOUND_MixToTemporary(iter, 0, x2, FALSE);
 			RtlReleaseResource(&iter->lock);
diff --git a/dlls/dsound/tests/ds3d.c b/dlls/dsound/tests/ds3d.c
index de3e38c..c3fa0ed 100644
--- a/dlls/dsound/tests/ds3d.c
+++ b/dlls/dsound/tests/ds3d.c
@@ -197,6 +197,9 @@ static int buffer_refill(play_state_t* state, DWORD size)
         state->written+=len2;
     }
     state->offset=state->written % state->buffer_size;
+    /* some apps blindly pass &ptr1 instead of ptr1 */
+    rc=IDirectSoundBuffer_Unlock(state->dsbo,&ptr1,len1,ptr2,len2);
+    ok(rc==DSERR_INVALIDPARAM, "IDDirectSoundBuffer_Unlock(): expected %08x got %08x, %p %p\n",DSERR_INVALIDPARAM, rc, &ptr1, ptr1);
     rc=IDirectSoundBuffer_Unlock(state->dsbo,ptr1,len1,ptr2,len2);
     ok(rc==DS_OK,"IDirectSoundBuffer_Unlock() failed: %08x\n", rc);
     if (rc!=DS_OK)