From: Jeff Smith Subject: [PATCH resend 4/5] d3drm: Strengthen check for valid viewport dimensions. Message-Id: <20190926220044.25245-4-whydoubt@gmail.com> Date: Thu, 26 Sep 2019 17:00:43 -0500 In-Reply-To: <20190926220044.25245-1-whydoubt@gmail.com> References: <20190926220044.25245-1-whydoubt@gmail.com> Signed-off-by: Jeff Smith --- dlls/d3drm/tests/d3drm.c | 32 ++++++++++++++++++++++++++++++++ dlls/d3drm/viewport.c | 16 ++++++++++++++-- 2 files changed, 46 insertions(+), 2 deletions(-) diff --git a/dlls/d3drm/tests/d3drm.c b/dlls/d3drm/tests/d3drm.c index d6f8322813..7317a316fa 100644 --- a/dlls/d3drm/tests/d3drm.c +++ b/dlls/d3drm/tests/d3drm.c @@ -1921,6 +1921,14 @@ static void test_Viewport(void) ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); viewport = (IDirect3DRMViewport *)0xdeadbeef; + hr = IDirect3DRM_CreateViewport(d3drm1, device1, frame, rc.left + 1, rc.top, rc.right, rc.bottom, &viewport); + ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); + ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); + viewport = (IDirect3DRMViewport *)0xdeadbeef; + hr = IDirect3DRM_CreateViewport(d3drm1, device1, frame, rc.left, rc.top + 1, rc.right, rc.bottom, &viewport); + ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); + ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); + viewport = (IDirect3DRMViewport *)0xdeadbeef; hr = IDirect3DRM_CreateViewport(d3drm1, device1, frame, rc.left, rc.top, rc.right + 1, rc.bottom + 1, &viewport); ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); @@ -1944,6 +1952,14 @@ static void test_Viewport(void) ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); viewport = (IDirect3DRMViewport *)0xdeadbeef; + hr = IDirect3DRM2_CreateViewport(d3drm2, device1, frame, rc.left + 1, rc.top, rc.right, rc.bottom, &viewport); + ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); + ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); + viewport = (IDirect3DRMViewport *)0xdeadbeef; + hr = IDirect3DRM2_CreateViewport(d3drm2, device1, frame, rc.left, rc.top + 1, rc.right, rc.bottom, &viewport); + ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); + ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); + viewport = (IDirect3DRMViewport *)0xdeadbeef; hr = IDirect3DRM2_CreateViewport(d3drm2, device1, frame, rc.left, rc.top, rc.right + 1, rc.bottom + 1, &viewport); ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); ok(!viewport, "Expected viewport returned == NULL, got %p.\n", viewport); @@ -1967,6 +1983,14 @@ static void test_Viewport(void) ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2); viewport2 = (IDirect3DRMViewport2 *)0xdeadbeef; + hr = IDirect3DRM3_CreateViewport(d3drm3, device3, frame3, rc.left + 1, rc.top, rc.right, rc.bottom, &viewport2); + ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); + ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2); + viewport2 = (IDirect3DRMViewport2 *)0xdeadbeef; + hr = IDirect3DRM3_CreateViewport(d3drm3, device3, frame3, rc.left, rc.top + 1, rc.right, rc.bottom, &viewport2); + ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); + ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2); + viewport2 = (IDirect3DRMViewport2 *)0xdeadbeef; hr = IDirect3DRM3_CreateViewport(d3drm3, device3, frame3, rc.left, rc.top, rc.right + 1, rc.bottom + 1, &viewport2); ok(hr == D3DRMERR_BADVALUE, "Expected hr == D3DRMERR_BADVALUE, got %#x.\n", hr); ok(!viewport2, "Expected viewport returned == NULL, got %p.\n", viewport2); @@ -2191,6 +2215,10 @@ static void test_Viewport(void) ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); hr = IDirect3DRMViewport_Init(viewport, device1, frame, rc.left, rc.top, rc.right, rc.bottom + 1); ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); + hr = IDirect3DRMViewport_Init(viewport, device1, frame, rc.left + 1, rc.top, rc.right, rc.bottom); + ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); + hr = IDirect3DRMViewport_Init(viewport, device1, frame, rc.left, rc.top + 1, rc.right, rc.bottom); + ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); device_ref = get_refcount((IUnknown *)device1); frame_ref = get_refcount((IUnknown *)frame); @@ -2409,6 +2437,10 @@ static void test_Viewport(void) ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); hr = IDirect3DRMViewport2_Init(viewport2, device3, frame3, rc.left, rc.top, rc.right, rc.bottom + 1); ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); + hr = IDirect3DRMViewport2_Init(viewport2, device3, frame3, rc.left + 1, rc.top, rc.right, rc.bottom); + ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); + hr = IDirect3DRMViewport2_Init(viewport2, device3, frame3, rc.left, rc.top + 1, rc.right, rc.bottom); + ok(hr == D3DRMERR_BADOBJECT, "Expected hr == D3DRMERR_BADOBJECT, got %#x.\n", hr); device_ref = get_refcount((IUnknown *)device3); frame_ref2 = get_refcount((IUnknown *)frame3); diff --git a/dlls/d3drm/viewport.c b/dlls/d3drm/viewport.c index 25a83e6e89..24fa198de5 100644 --- a/dlls/d3drm/viewport.c +++ b/dlls/d3drm/viewport.c @@ -300,6 +300,19 @@ static HRESULT WINAPI d3drm_viewport1_GetClassName(IDirect3DRMViewport *iface, D return d3drm_viewport2_GetClassName(&viewport->IDirect3DRMViewport2_iface, size, name); } +static HRESULT d3drm_viewport_check_device_dims(struct d3drm_device *device, + DWORD x, DWORD y, DWORD width, DWORD height) +{ + if (x > device->width || y > device->height + || width > device->width || height > device->height + || x + width > device->width || y + height > device->height) + { + return D3DRMERR_BADVALUE; + } + + return D3D_OK; +} + static HRESULT WINAPI d3drm_viewport2_Init(IDirect3DRMViewport2 *iface, IDirect3DRMDevice3 *device, IDirect3DRMFrame3 *camera, DWORD x, DWORD y, DWORD width, DWORD height) { @@ -317,8 +330,7 @@ static HRESULT WINAPI d3drm_viewport2_Init(IDirect3DRMViewport2 *iface, IDirect3 iface, device, camera, x, y, width, height); if (!device_obj || !camera - || width > device_obj->width - || height > device_obj->height) + || FAILED(d3drm_viewport_check_device_dims(device_obj, x, y, width, height))) { return D3DRMERR_BADOBJECT; } -- 2.21.0