marko10_000
/
wine-wine
forked from Mirrors/wine-wine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

d3d10: Validate the base offset in parse_fx10_body() (AFL). 

Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
oldstable
Henri Verbeet 2016-05-26 19:36:56 +02:00 committed by Alexandre Julliard
parent e36630f702
commit 200bfa97a8
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
dlls/d3d10/effect.c
View File

@ -2104,10 +2104,17 @@ static void d3d10_effect_type_destroy(struct wine_rb_entry *entry, void *context
static HRESULT parse_fx10_body(struct d3d10_effect *e, const char *data, DWORD data_size)
{
const char *ptr = data + e->index_offset;
const char *ptr;
unsigned int i;
HRESULT hr;
if (e->index_offset >= data_size)
{
WARN("Invalid index offset %#x (data size %#x).\n", e->index_offset, data_size);
return E_FAIL;
}
ptr = data + e->index_offset;
if (!(e->local_buffers = d3d10_calloc(e->local_buffer_count, sizeof(*e->local_buffers))))
{
ERR("Failed to allocate local buffer memory.\n");