This is to avoid reading beyond the input buffer in `get_shader_semantics`.
[Testbot run with this patch](https://testbot.winehq.org/JobDetails.pl?Key=160604)
<details> <summary>ASan report details</summary>
``` ================================================================= ==1268==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000140212064 at pc 0x6ffffad7854b bp 0x7ffffe1ff740 sp 0x7ffffe1ff788 READ of size 4 at 0x000140212064 thread T0 #0 0x6ffffad7854a in get_shader_semantics .../wine/dlls/d3dx9_36/shader.c:2842 #1 0x6ffffad77c3b in D3DXGetShaderInputSemantics .../wine/dlls/d3dx9_36/shader.c:3008 #2 0x0001400c9006 in test_shader_semantics .../wine/dlls/d3dx9_36/tests/shader.c:6754 #3 0x0001400c1925 in func_shader .../wine/dlls/d3dx9_36/tests/shader.c:6983 #4 0x000140127d92 in run_test .../wine/include/wine/test.h:768 #5 0x00014012779b in main .../wine/include/wine/test.h:888 #6 0x000140129a6a in mainCRTStartup .../wine/dlls/msvcrt/crt_main.c:62 #7 0x6fffffc67a74 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027a74) #8 0x6fffffde06a6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x1700506a6)
0x000140212064 is located 60 bytes before global variable 'test_shader_semantics.vs_1_1' defined in '.../wine/dlls/d3dx9_36/tests/shader.c:6650' (0x0001402120a0) of size 116 0x000140212064 is located 28 bytes before global variable 'test_shader_semantics.invalid_3' defined in '.../wine/dlls/d3dx9_36/tests/shader.c:6646' (0x000140212080) of size 4 0x000140212064 is located 0 bytes after global variable 'test_shader_semantics.invalid_2' defined in '.../wine/dlls/d3dx9_36/tests/shader.c:6642' (0x000140212060) of size 4 SUMMARY: AddressSanitizer: global-buffer-overflow .../wine/dlls/d3dx9_36/shader.c:2842 in get_shader_semantics Shadow bytes around the buggy address: 0x000140211d80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x000140211e00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x000140211e80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x000140211f00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x000140211f80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 =>0x000140212000: f9 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9[04]f9 f9 f9 0x000140212080: 04 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x000140212100: 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x000140212180: 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 0x000140212200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x000140212280: 00 00 00 04 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1268==ABORTING ```
</details>
-- v2: d3dx9_36/tests: Add end marker to the invalid tests (ASan).
From: Bernhard Übelacker bernhardu@mailbox.org
This is to avoid reading beyond the input buffer in `get_shader_semantics`. --- dlls/d3dx9_36/tests/shader.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/dlls/d3dx9_36/tests/shader.c b/dlls/d3dx9_36/tests/shader.c index 27e2008cde4..9b28a168a0d 100644 --- a/dlls/d3dx9_36/tests/shader.c +++ b/dlls/d3dx9_36/tests/shader.c @@ -6639,11 +6639,13 @@ static void test_shader_semantics(void) }, invalid_2[] = { - 0xfffe0400 + 0xfffe0400, + 0x0000ffff }, invalid_3[] = { - 0xfffe0000 + 0xfffe0000, + 0x0000ffff }, vs_1_1[] = {
v2: - Just corrected typo in patch/MR description.
On Tue Nov 4 17:19:32 2025 +0000, Matteo Bruni wrote:
Nitpick: typo in the MR description.
Thanks for catching this, this is fixed in v2.
-
Bernhard Übelacker -
Bernhard Übelacker (＠bernhardu)