dsound: Check for invalid parameter when unlocking secondary buffers.

dlls/dsound/buffer.c

@@ -735,7 +735,12 @@ static HRESULT WINAPI IDirectSoundBufferImpl_Unlock(
 		{
 			RtlAcquireResourceShared(&iter->lock, TRUE);
 			if (x1)
-				DSOUND_MixToTemporary(iter, (DWORD_PTR)p1 - (DWORD_PTR)iter->buffer->memory, x1, FALSE);
+                        {
+			    if(x1 + (DWORD_PTR)p1 - (DWORD_PTR)iter->buffer->memory > iter->buflen)
+			      hres = DSERR_INVALIDPARAM;
+			    else
+			      DSOUND_MixToTemporary(iter, (DWORD_PTR)p1 - (DWORD_PTR)iter->buffer->memory, x1, FALSE);
+                        }
 			if (x2)
 				DSOUND_MixToTemporary(iter, 0, x2, FALSE);
 			RtlReleaseResource(&iter->lock);

dlls/dsound/tests/ds3d.c

@@ -197,6 +197,9 @@ static int buffer_refill(play_state_t* state, DWORD size)
         state->written+=len2;
     }
     state->offset=state->written % state->buffer_size;
+    /* some apps blindly pass &ptr1 instead of ptr1 */
+    rc=IDirectSoundBuffer_Unlock(state->dsbo,&ptr1,len1,ptr2,len2);
+    ok(rc==DSERR_INVALIDPARAM, "IDDirectSoundBuffer_Unlock(): expected %08x got %08x, %p %p\n",DSERR_INVALIDPARAM, rc, &ptr1, ptr1);
     rc=IDirectSoundBuffer_Unlock(state->dsbo,ptr1,len1,ptr2,len2);
     ok(rc==DS_OK,"IDirectSoundBuffer_Unlock() failed: %08x\n", rc);
     if (rc!=DS_OK)