Module: wine
Branch: master
Commit: 719cd82f3584dd6a863f0b7d2fca429e24d3bdca
URL: http://source.winehq.org/git/wine.git/?a=commit;h=719cd82f3584dd6a863f0b7d2…
Author: Rob Shearman <rob(a)codeweavers.com>
Date: Mon Feb 18 19:37:35 2008 +0000
wininet: Fix potential buffer overrun in HttpQueryInfoA.
If HTTP_QUERY_CUSTOM is specified then the buffer contains a
null-terminated string on input and data of length len on output. The
code wasn't taking into account that the input len could …
[View More]be less than
the length of the string and thus could result in the allocated buffer
being overrun with the call to WideCharToMultiByte.
---
dlls/wininet/http.c | 13 +++++++++++--
1 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c
index 9e02d69..f27f828 100644
--- a/dlls/wininet/http.c
+++ b/dlls/wininet/http.c
@@ -1982,11 +1982,20 @@ BOOL WINAPI HttpQueryInfoA(HINTERNET hHttpRequest, DWORD dwInfoLevel,
if (lpBuffer)
{
+ DWORD alloclen;
len = (*lpdwBufferLength)*sizeof(WCHAR);
- bufferW = HeapAlloc( GetProcessHeap(), 0, len );
+ if ((dwInfoLevel & HTTP_QUERY_HEADER_MASK) == HTTP_QUERY_CUSTOM)
+ {
+ alloclen = MultiByteToWideChar( CP_ACP, 0, lpBuffer, -1, NULL, 0 ) * sizeof(WCHAR);
+ if (alloclen < len)
+ alloclen = len;
+ }
+ else
+ alloclen = len;
+ bufferW = HeapAlloc( GetProcessHeap(), 0, alloclen );
/* buffer is in/out because of HTTP_QUERY_CUSTOM */
if ((dwInfoLevel & HTTP_QUERY_HEADER_MASK) == HTTP_QUERY_CUSTOM)
- MultiByteToWideChar(CP_ACP,0,lpBuffer,-1,bufferW,len);
+ MultiByteToWideChar( CP_ACP, 0, lpBuffer, -1, bufferW, alloclen / sizeof(WCHAR) );
} else
{
bufferW = NULL;
[View Less]
Module: wine
Branch: master
Commit: 5346039d5ad0a89df6d3d6656adecbae8ff3f214
URL: http://source.winehq.org/git/wine.git/?a=commit;h=5346039d5ad0a89df6d3d6656…
Author: Alexander Dorofeyev <alexd4(a)inbox.lv>
Date: Sun Feb 17 17:37:00 2008 -0800
wined3d: Take alpha from device palette entry for d3d 8 and later.
Adds support for D3D >= 8 style palettes that contain alpha. This fixes
rendering problems in games like Commandos 3 and Madden NFL 2004.
---
dlls/wined3d/surface.c | …
[View More]28 ++++++++++++++++++----------
1 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/dlls/wined3d/surface.c b/dlls/wined3d/surface.c
index 6a17949..c6b8403 100644
--- a/dlls/wined3d/surface.c
+++ b/dlls/wined3d/surface.c
@@ -2000,6 +2000,7 @@ static void d3dfmt_p8_init_palette(IWineD3DSurfaceImpl *This, BYTE table[256][4]
IWineD3DPaletteImpl* pal = This->palette;
IWineD3DDeviceImpl *device = This->resource.wineD3DDevice;
BOOL index_in_alpha = FALSE;
+ int dxVersion = ( (IWineD3DImpl *) device->wineD3D)->dxVersion;
int i;
/* Old games like StarCraft, C&C, Red Alert and others use P8 render targets.
@@ -2016,22 +2017,29 @@ static void d3dfmt_p8_init_palette(IWineD3DSurfaceImpl *This, BYTE table[256][4]
if (pal == NULL) {
/* Still no palette? Use the device's palette */
- /* Get the surface's palette */
+ /* can ddraw and d3d < 8 surfaces use device's palette (d3d >= 8 feature)? */
for (i = 0; i < 256; i++) {
table[i][0] = device->palettes[device->currentPalette][i].peRed;
table[i][1] = device->palettes[device->currentPalette][i].peGreen;
table[i][2] = device->palettes[device->currentPalette][i].peBlue;
- /* BltOverride uses a GL_ALPHA_TEST based on GL_NOT_EQUAL 0, so the alpha component
- of pixels that should be masked away should be 0. When inde_in_alpha is set,
- we will store the palette index (the glReadPixels code reads GL_ALPHA back)
- or else we store 0xff. */
- if(colorkey && (i >= This->SrcBltCKey.dwColorSpaceLowValue) && (i <= This->SrcBltCKey.dwColorSpaceHighValue)) {
- table[i][3] = 0;
- } else if(index_in_alpha) {
- table[i][3] = i;
+ if(dxVersion >= 8) {
+ /* Direct3D >= 8 palette usage style: P8 textures use device palettes, palette entry format is A8R8G8B8,
+ alpha is stored in peFlags and may be used by the app if D3DPTEXTURECAPS_ALPHAPALETTE device
+ capability flag is present (wine does advertise this capability) */
+ table[i][3] = device->palettes[device->currentPalette][i].peFlags;
} else {
- table[i][3] = 0xFF;
+ /* BltOverride uses a GL_ALPHA_TEST based on GL_NOT_EQUAL 0, so the alpha component
+ of pixels that should be masked away should be 0. When inde_in_alpha is set,
+ we will store the palette index (the glReadPixels code reads GL_ALPHA back)
+ or else we store 0xff. */
+ if(colorkey && (i >= This->SrcBltCKey.dwColorSpaceLowValue) && (i <= This->SrcBltCKey.dwColorSpaceHighValue)) {
+ table[i][3] = 0;
+ } else if(index_in_alpha) {
+ table[i][3] = i;
+ } else {
+ table[i][3] = 0xFF;
+ }
}
}
} else {
[View Less]