dsound: Validate buffer pointers in Unlock methods.

dlls/dsound/buffer.c

@@ -651,6 +651,12 @@ static HRESULT WINAPI IDirectSoundBufferImpl_Unlock(IDirectSoundBuffer8 *iface,
 	if (!p2)
 		x2 = 0;
 
+    if((p1 && ((BYTE*)p1 < This->buffer->memory ||
+                    (BYTE*)p1 >= This->buffer->memory + This->buflen)) ||
+            (p2 && ((BYTE*)p2 < This->buffer->memory ||
+                    (BYTE*)p2 >= This->buffer->memory + This->buflen)))
+        return DSERR_INVALIDPARAM;
+
 	if (x1 || x2)
 	{
 		RtlAcquireResourceShared(&This->device->buffer_list_lock, TRUE);

dlls/dsound/primary.c

@@ -850,6 +850,12 @@ static HRESULT WINAPI PrimaryBufferImpl_Unlock(
 		return DSERR_PRIOLEVELNEEDED;
 	}
 
+    if((p1 && ((BYTE*)p1 < device->buffer ||
+                    (BYTE*)p1 >= device->buffer + device->buflen)) ||
+            (p2 && ((BYTE*)p2 < device->buffer ||
+                    (BYTE*)p2 >= device->buffer + device->buflen)))
+        return DSERR_INVALIDPARAM;
+
 	return DS_OK;
 }