From: Henri Verbeet <hverbeet@codeweavers.com>
Subject: [PATCH 1/5] wined3d: Validate "data" in wined3d_texture_upload_data().
Message-Id: <1438328792-14825-1-git-send-email-hverbeet@codeweavers.com>
Date: Fri, 31 Jul 2015 09:46:28 +0200

---
 dlls/d3d10core/tests/device.c |  8 ++++++++
 dlls/wined3d/texture.c        | 22 +++++++++++++++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/dlls/d3d10core/tests/device.c b/dlls/d3d10core/tests/device.c
index 0b03285..edfa33f 100644
--- a/dlls/d3d10core/tests/device.c
+++ b/dlls/d3d10core/tests/device.c
@@ -164,6 +164,7 @@ static IDXGISwapChain *create_swapchain(ID3D10Device *device, HWND window, BOOL
 static void test_create_texture2d(void)
 {
     ULONG refcount, expected_refcount;
+    D3D10_SUBRESOURCE_DATA data = {0};
     ID3D10Device *device, *tmp;
     D3D10_TEXTURE2D_DESC desc;
     ID3D10Texture2D *texture;
@@ -188,6 +189,9 @@ static void test_create_texture2d(void)
     desc.CPUAccessFlags = 0;
     desc.MiscFlags = 0;
 
+    hr = ID3D10Device_CreateTexture2D(device, &desc, &data, &texture);
+    ok(hr == E_INVALIDARG, "Got unexpected hr %#x.\n", hr);
+
     expected_refcount = get_refcount((IUnknown *)device) + 1;
     hr = ID3D10Device_CreateTexture2D(device, &desc, NULL, &texture);
     ok(SUCCEEDED(hr), "Failed to create a 2d texture, hr %#x\n", hr);
@@ -255,6 +259,7 @@ static void test_create_texture2d(void)
 static void test_create_texture3d(void)
 {
     ULONG refcount, expected_refcount;
+    D3D10_SUBRESOURCE_DATA data = {0};
     ID3D10Device *device, *tmp;
     D3D10_TEXTURE3D_DESC desc;
     ID3D10Texture3D *texture;
@@ -277,6 +282,9 @@ static void test_create_texture3d(void)
     desc.CPUAccessFlags = 0;
     desc.MiscFlags = 0;
 
+    hr = ID3D10Device_CreateTexture3D(device, &desc, &data, &texture);
+    ok(hr == E_INVALIDARG, "Got unexpected hr %#x.\n", hr);
+
     expected_refcount = get_refcount((IUnknown *)device) + 1;
     hr = ID3D10Device_CreateTexture3D(device, &desc, NULL, &texture);
     ok(SUCCEEDED(hr), "Failed to create a 3d texture, hr %#x.\n", hr);
diff --git a/dlls/wined3d/texture.c b/dlls/wined3d/texture.c
index 1e039e4..82694bb 100644
--- a/dlls/wined3d/texture.c
+++ b/dlls/wined3d/texture.c
@@ -727,12 +727,22 @@ HRESULT CDECL wined3d_texture_add_dirty_region(struct wined3d_texture *texture,
     return WINED3D_OK;
 }
 
-static void wined3d_texture_upload_data(struct wined3d_texture *texture, const struct wined3d_sub_resource_data *data)
+static HRESULT wined3d_texture_upload_data(struct wined3d_texture *texture,
+        const struct wined3d_sub_resource_data *data)
 {
     unsigned int sub_count = texture->level_count * texture->layer_count;
     struct wined3d_context *context;
     unsigned int i;
 
+    for (i = 0; i < sub_count; ++i)
+    {
+        if (!data[i].data)
+        {
+            WARN("Invalid sub-resource data specified for sub-resource %u.\n", i);
+            return E_INVALIDARG;
+        }
+    }
+
     context = context_acquire(texture->resource.device, NULL);
 
     wined3d_texture_prepare_texture(texture, context, FALSE);
@@ -748,6 +758,8 @@ static void wined3d_texture_upload_data(struct wined3d_texture *texture, const s
     }
 
     context_release(context);
+
+    return WINED3D_OK;
 }
 
 static void texture2d_sub_resource_load(struct wined3d_resource *sub_resource,
@@ -1444,8 +1456,12 @@ HRESULT CDECL wined3d_texture_create(struct wined3d_device *device, const struct
 
     /* FIXME: We'd like to avoid ever allocating system memory for the texture
      * in this case. */
-    if (data)
-        wined3d_texture_upload_data(object, data);
+    if (data && FAILED(hr = wined3d_texture_upload_data(object, data)))
+    {
+        wined3d_texture_cleanup(object);
+        HeapFree(GetProcessHeap(), 0, object);
+        return hr;
+    }
 
     TRACE("Created texture %p.\n", object);
     *texture = object;

-- 
2.1.4