Stefan Dösinger : wined3d: Perform sanity checks on the rectangle in LockRect.

[Alexandre Julliard]

Module: wine
Branch: refs/heads/master
Commit: 77448f588b888ecc724c7ead9f28629f3f661d27
URL:    http://source.winehq.org/git/?p=wine.git;a=commit;h=77448f588b888ecc724c7ead...

Author: Stefan Dösinger 
Date:   Thu Jun 29 21:13:12 2006 +0200

wined3d: Perform sanity checks on the rectangle in LockRect.

---

dlls/wined3d/surface.c     |   11 +++++++++++
 dlls/wined3d/surface_gdi.c |   11 +++++++++++
 2 files changed, 22 insertions(+), 0 deletions(-)

diff --git a/dlls/wined3d/surface.c b/dlls/wined3d/surface.c
index da8f766..e3c8682 100644
--- a/dlls/wined3d/surface.c
+++ b/dlls/wined3d/surface.c
@@ -348,6 +348,17 @@ static HRESULT WINAPI IWineD3DSurfaceImp
     } else {
         TRACE("Lock Rect (%p) = l %ld, t %ld, r %ld, b %ld\n", pRect, pRect->left, pRect->top, pRect->right, pRect->bottom);

+        if ((pRect->top < 0) ||
+             (pRect->left < 0) ||
+             (pRect->left >= pRect->right) ||
+             (pRect->top >= pRect->bottom) ||
+             (pRect->right > This->currentDesc.Width) ||
+             (pRect->bottom > This->currentDesc.Height))
+        {
+            WARN(" Invalid values in pRect !!!\n");
+            return D3DERR_INVALIDCALL;
+        }
+
         if (This->resource.format == WINED3DFMT_DXT1) { /* DXT1 is half byte per pixel */
             pLockedRect->pBits = This->resource.allocatedMemory + (pLockedRect->Pitch * pRect->top) + ((pRect->left * This->bytesPerPixel / 2));
         } else {
diff --git a/dlls/wined3d/surface_gdi.c b/dlls/wined3d/surface_gdi.c
index e1d082d..ddea727 100644
--- a/dlls/wined3d/surface_gdi.c
+++ b/dlls/wined3d/surface_gdi.c
@@ -196,6 +196,17 @@ IWineGDISurfaceImpl_LockRect(IWineD3DSur
         TRACE("Lock Rect (%p) = l %ld, t %ld, r %ld, b %ld\n",
               pRect, pRect->left, pRect->top, pRect->right, pRect->bottom);

+        if ((pRect->top < 0) ||
+             (pRect->left < 0) ||
+             (pRect->left >= pRect->right) ||
+             (pRect->top >= pRect->bottom) ||
+             (pRect->right > This->currentDesc.Width) ||
+             (pRect->bottom > This->currentDesc.Height))
+        {
+            WARN(" Invalid values in pRect !!!\n");
+            return D3DERR_INVALIDCALL;
+        }
+
         if (This->resource.format == WINED3DFMT_DXT1)
         {
             /* DXT1 is half byte per pixel */