[PATCH 0/1] MR7710: d3d10/effect: Fix constant buffer overrun when updating expression constants (ASan).

[Nikolay Sivov (＠nsivov)]

Signed-off-by: Nikolay Sivov

[PATCH 1/1] d3d10/effect: Fix constant buffer overrun when updating expression constants (ASan).

[Nikolay Sivov]

From: Nikolay Sivov

Signed-off-by: Nikolay Sivov 
---
 dlls/d3d10/effect.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/dlls/d3d10/effect.c b/dlls/d3d10/effect.c
index 02e71e4dcee..f27a128f15d 100644
--- a/dlls/d3d10/effect.c
+++ b/dlls/d3d10/effect.c
@@ -940,8 +940,13 @@ static HRESULT d3d10_effect_preshader_eval(struct d3d10_effect_preshader *p)
     for (i = 0; i < p->vars_count; ++i)
     {
         struct d3d10_ctab_var *v = &p->vars[i];
-        memcpy(dst + v->offset, v->v->buffer->u.buffer.local_buffer + v->v->buffer_offset,
-                v->length * sizeof(*dst));
+        size_t size;
+
+        /* Constant table variables are allocated at register granularity.
+           Corresponding constant buffer variables does not share same alignment,
+           overall buffer size alignment to 16 bytes also does not help. */
+        size = min(v->length * sizeof(*dst), v->v->type->size_unpacked);
+        memcpy(dst + v->offset, v->v->buffer->u.buffer.local_buffer + v->v->buffer_offset, size);
     }

instr_count = *ip++;

[Matteo Bruni (＠Mystral)]

Matteo Bruni (@Mystral) commented about dlls/d3d10/effect.c:
>  for (i = 0; i < p->vars_count; ++i)
>  {
>      struct d3d10_ctab_var *v = &p->vars[i];
> -
>    memcpy(dst + v->offset, v->v->buffer->u.buffer.local_buffer + v->v->buffer_offset,
> -
>            v->length * sizeof(*dst));
> -
>    size_t size;
> -
> -
>    /* Constant table variables are allocated at register granularity.
> -
>       Corresponding constant buffer variables does not share same alignment,
> -
>       overall buffer size alignment to 16 bytes also does not help. */
> -
>    size = min(v->length * sizeof(*dst), v->v->type->size_unpacked);
> -
>    memcpy(dst + v->offset, v->v->buffer->u.buffer.local_buffer + v->v->buffer_offset, size);

Double checking I understand this correctly: this fixes a potential out of bounds while *reading from* `local_buffer`?

[PATCH 0/1] MR7710: d3d10/effect: Fix constant buffer overrun when updating expression constants (ASan). - approved

[Matteo Bruni (＠Mystral)]

This merge request was approved by Matteo Bruni.

[Nikolay Sivov (＠nsivov)]

On Fri Apr  4 12:45:46 2025 +0000, Matteo Bruni wrote:
> Double checking I understand this correctly: this fixes a potential out
> of bounds while *reading from* `local_buffer`?

Correct.