d3drm: Also validate face indices against the vertex count in load_mesh_data() (Valgrind).

e723d2a0 · Henri Verbeet · Alexandre Julliard · fdd22f19 · e723d2a0
Commit e723d2a0 authored May 04, 2015 by Henri Verbeet Committed by Alexandre Julliard May 04, 2015
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletion

meshbuilder.c dlls/d3drm/meshbuilder.c +4 -1

No files found.
--- a/dlls/d3drm/meshbuilder.c
+++ b/dlls/d3drm/meshbuilder.c
@@ -1368,7 +1368,10 @@ HRESULT load_mesh_data(IDirect3DRMMeshBuilder3 *iface, IDirectXFileData *pData,
        if (!This->nb_normals)
        {
            /* Compute face normal */
-            if (nb_face_indexes > 2)
+            if (nb_face_indexes > 2
+                    && faces_vertex_idx_ptr[0] < This->nb_vertices
+                    && faces_vertex_idx_ptr[1] < This->nb_vertices
+                    && faces_vertex_idx_ptr[2] < This->nb_vertices)
            {
                D3DVECTOR a, b;