https://bugs.winehq.org/show_bug.cgi?id=57300
Fabian Maurer dark.shadow4@web.de changed:
What |Removed |Added ---------------------------------------------------------------------------- URL| |http://ftp.vector.co.jp/34/ | |19/1946/Knight050.lzh Keywords| |download, regression Regression SHA1| |aeb68e5df4b340d75366bb19d55 | |75a70a121e3cb
--- Comment #1 from Fabian Maurer dark.shadow4@web.de --- Bisected to commit aeb68e5df4b340d75366bb19d5575a70a121e3cb Author: Elizabeth Figura zfigura@codeweavers.com Date: Wed Nov 15 11:14:22 2023 -0600
wined3d: Feed WINED3D_TSS_CONSTANT through a push constant buffer.
The issue is caused by moving "struct list changed_lights;" to the top of the struct. Moving it back down makes it work again.
The issue is an overflow inside d3d_device2_SwapTextureHandles
device->handle_table.entries[h2].object = surf1;
This writes a value into changed_lights, which it shouldn't.
The entry table has size 64:
if (!ddraw_handle_table_init(&device->handle_table, 64))
The surf1 value is 68 though, so it is out of bounds. Not quite sure how to best fix. Is it allowed to have more than 64 values?