On 2/10/20 8:37 AM, Henri Verbeet wrote:
On Sat, 8 Feb 2020 at 07:42, Zebediah Figura z.figura12@gmail.com wrote:
- if (reg_idx >= device->vs_uniform_count || reg_idx + count > device->vs_uniform_count) {
"reg_idx + count" can overflow. In principle that's an existing issue, but previously wined3d_device_get_vs_consts_f() would have caught it.
Ah, right. I should have wondered why it was written that way to begin with...
- hr = wined3d_device_get_vs_consts_i(device->wined3d_device,
reg_idx, count, (struct wined3d_ivec4 *)data);
- memcpy(data, &wined3d_stateblock_get_state(device->state)->vs_consts_i[reg_idx], count * sizeof(struct wined3d_ivec4));
It's just a tought, but the following may be slightly more natural:
const struct wined3d_ivec4 *src =
wined3d_stateblock_get_state(device->state)->vs_consts_i; memcpy(data, &src[reg_idx], count * sizeof(*src));
Yeah, probably.