From: Henri Verbeet <hverbeet@codeweavers.com>
Subject: [PATCH 2/5] wined3d: Validate "data" in buffer_init().
Message-Id: <1438328792-14825-2-git-send-email-hverbeet@codeweavers.com>
Date: Fri, 31 Jul 2015 09:46:29 +0200

---
 dlls/d3d10core/buffer.c       |  7 +++----
 dlls/d3d10core/tests/device.c |  4 ++++
 dlls/wined3d/buffer.c         | 13 ++++++++++---
 include/wine/wined3d.h        |  3 ++-
 4 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/dlls/d3d10core/buffer.c b/dlls/d3d10core/buffer.c
index 84882a7..af0dd9c 100644
--- a/dlls/d3d10core/buffer.c
+++ b/dlls/d3d10core/buffer.c
@@ -239,10 +239,9 @@ HRESULT d3d10_buffer_init(struct d3d10_buffer *buffer, struct d3d10_device *devi
     wined3d_desc.cpu_access_flags = desc->CPUAccessFlags;
     wined3d_desc.misc_flags = desc->MiscFlags;
 
-    hr = wined3d_buffer_create(device->wined3d_device, &wined3d_desc,
-            data ? data->pSysMem : NULL, buffer, &d3d10_buffer_wined3d_parent_ops,
-            &buffer->wined3d_buffer);
-    if (FAILED(hr))
+    if (FAILED(hr = wined3d_buffer_create(device->wined3d_device, &wined3d_desc,
+            (const struct wined3d_sub_resource_data *)data, buffer,
+            &d3d10_buffer_wined3d_parent_ops, &buffer->wined3d_buffer)))
     {
         WARN("Failed to create wined3d buffer, hr %#x.\n", hr);
         wined3d_private_store_cleanup(&buffer->private_store);
diff --git a/dlls/d3d10core/tests/device.c b/dlls/d3d10core/tests/device.c
index edfa33f..c75def4 100644
--- a/dlls/d3d10core/tests/device.c
+++ b/dlls/d3d10core/tests/device.c
@@ -397,6 +397,7 @@ static void test_create_depthstencil_view(void)
 static void test_create_rendertarget_view(void)
 {
     D3D10_RENDER_TARGET_VIEW_DESC rtv_desc;
+    D3D10_SUBRESOURCE_DATA data = {0};
     D3D10_TEXTURE2D_DESC texture_desc;
     ULONG refcount, expected_refcount;
     D3D10_BUFFER_DESC buffer_desc;
@@ -418,6 +419,9 @@ static void test_create_rendertarget_view(void)
     buffer_desc.CPUAccessFlags = 0;
     buffer_desc.MiscFlags = 0;
 
+    hr = ID3D10Device_CreateBuffer(device, &buffer_desc, &data, &buffer);
+    ok(hr == E_INVALIDARG, "Got unexpected hr %#x.\n", hr);
+
     expected_refcount = get_refcount((IUnknown *)device) + 1;
     hr = ID3D10Device_CreateBuffer(device, &buffer_desc, NULL, &buffer);
     ok(SUCCEEDED(hr), "Failed to create a buffer, hr %#x\n", hr);
diff --git a/dlls/wined3d/buffer.c b/dlls/wined3d/buffer.c
index ea584df..40a137e 100644
--- a/dlls/wined3d/buffer.c
+++ b/dlls/wined3d/buffer.c
@@ -1132,7 +1132,7 @@ static const struct wined3d_resource_ops buffer_resource_ops =
 
 static HRESULT buffer_init(struct wined3d_buffer *buffer, struct wined3d_device *device,
         UINT size, DWORD usage, enum wined3d_format_id format_id, enum wined3d_pool pool, GLenum bind_hint,
-        const char *data, void *parent, const struct wined3d_parent_ops *parent_ops)
+        const struct wined3d_sub_resource_data *data, void *parent, const struct wined3d_parent_ops *parent_ops)
 {
     const struct wined3d_gl_info *gl_info = &device->adapter->gl_info;
     const struct wined3d_format *format = wined3d_get_format(gl_info, format_id);
@@ -1145,6 +1145,12 @@ static HRESULT buffer_init(struct wined3d_buffer *buffer, struct wined3d_device
         return WINED3DERR_INVALIDCALL;
     }
 
+    if (data && !data->data)
+    {
+        WARN("Invalid sub-resource data specified.\n");
+        return E_INVALIDARG;
+    }
+
     hr = resource_init(&buffer->resource, device, WINED3D_RTYPE_BUFFER, format,
             WINED3D_MULTISAMPLE_NONE, 0, usage, pool, size, 1, 1, size, parent, parent_ops, &buffer_resource_ops);
     if (FAILED(hr))
@@ -1205,7 +1211,7 @@ static HRESULT buffer_init(struct wined3d_buffer *buffer, struct wined3d_device
             return hr;
         }
 
-        memcpy(ptr, data, size);
+        memcpy(ptr, data->data, size);
 
         wined3d_buffer_unmap(buffer);
     }
@@ -1224,7 +1230,8 @@ static HRESULT buffer_init(struct wined3d_buffer *buffer, struct wined3d_device
 }
 
 HRESULT CDECL wined3d_buffer_create(struct wined3d_device *device, const struct wined3d_buffer_desc *desc,
-        const void *data, void *parent, const struct wined3d_parent_ops *parent_ops, struct wined3d_buffer **buffer)
+        const struct wined3d_sub_resource_data *data, void *parent, const struct wined3d_parent_ops *parent_ops,
+        struct wined3d_buffer **buffer)
 {
     struct wined3d_buffer *object;
     HRESULT hr;
diff --git a/include/wine/wined3d.h b/include/wine/wined3d.h
index 6ff1a3e..9786c3c 100644
--- a/include/wine/wined3d.h
+++ b/include/wine/wined3d.h
@@ -2113,7 +2113,8 @@ HRESULT __cdecl wined3d_set_adapter_display_mode(struct wined3d *wined3d,
         UINT adapter_idx, const struct wined3d_display_mode *mode);
 
 HRESULT __cdecl wined3d_buffer_create(struct wined3d_device *device, const struct wined3d_buffer_desc *desc,
-        const void *data, void *parent, const struct wined3d_parent_ops *parent_ops, struct wined3d_buffer **buffer);
+        const struct wined3d_sub_resource_data *data, void *parent, const struct wined3d_parent_ops *parent_ops,
+        struct wined3d_buffer **buffer);
 HRESULT __cdecl wined3d_buffer_create_ib(struct wined3d_device *device, UINT length, DWORD usage,
         enum wined3d_pool pool, void *parent, const struct wined3d_parent_ops *parent_ops,
         struct wined3d_buffer **buffer);

-- 
2.1.4