Józef Kucia : wined3d: Prevent possible integer overflow in buffer_invalidate_bo_range().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 446ee50b904f9caa8556de6cc8607bea6f9a49d7
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=446ee50b904f9caa8556de6cc8...

Author: Józef Kucia <jkucia(a)codeweavers.com>
Date:   Sun Mar 20 23:15:30 2016 +0100

wined3d: Prevent possible integer overflow in buffer_invalidate_bo_range().

Signed-off-by: Józef Kucia <jkucia(a)codeweavers.com>
Signed-off-by: Henri Verbeet <hverbeet(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/wined3d/buffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/wined3d/buffer.c b/dlls/wined3d/buffer.c
index 70a7a20..3d4ab55 100644
--- a/dlls/wined3d/buffer.c
+++ b/dlls/wined3d/buffer.c
@@ -47,7 +47,7 @@ static void buffer_invalidate_bo_range(struct wined3d_buffer *buffer, unsigned i
     if (!offset && (!size || size == buffer->resource.size))
         goto invalidate_all;
 
-    if (offset > buffer->resource.size || offset + size > buffer->resource.size)
+    if (offset > buffer->resource.size || size > buffer->resource.size - offset)
     {
         WARN("Invalid range specified, invalidating entire buffer.\n");
         goto invalidate_all;