wined3d: Avoid potential out-of-bounds memory access in surface_cpu_blt_colour_fill().

Draw rects are derived from the current viewport. It is possible to produce a clear operation with a draw rect which lies completely outside of one of render targets in D3D9. It seems that we never use the CPU blitter for D3D9 render target clears, so it might not be a problem in practice. Signed-off-by: Józef Kucia <jkucia@codeweavers.com> Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

wined3d: Avoid potential out-of-bounds memory access in surface_cpu_blt_colour_fill().
e37b9c74 · Józef Kucia · Alexandre Julliard · 25ced030 · e37b9c74
Commit e37b9c74 authored Jan 16, 2019 by Józef Kucia Committed by Alexandre Julliard Jan 17, 2019
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

surface.c dlls/wined3d/surface.c +2 -2

No files found.
--- a/dlls/wined3d/surface.c
+++ b/dlls/wined3d/surface.c
@@ -2970,8 +2970,8 @@ static void surface_cpu_blt_colour_fill(struct wined3d_rendertarget_view *view,
    c = wined3d_format_convert_from_float(view->format, colour);
    bpp = view->format->byte_count;
-    w = min(box->right, view->width) - box->left;
+    w = min(box->right, view->width) - min(box->left, view->width);
-    h = min(box->bottom, view->height) - box->top;
+    h = min(box->bottom, view->height) - min(box->top, view->height);
    texture = texture_from_resource(view->resource);
    map_binding = texture->resource.map_binding;