https://git.reactos.org/?p=reactos.git;a=commitdiff;h=51b2c71b54c551b0b97a4c89bbfbf0e958b0b36e
commit 51b2c71b54c551b0b97a4c89bbfbf0e958b0b36e Author: winesync <[email protected]> AuthorDate: Mon Sep 21 23:07:32 2020 +0200 Commit: Jérôme Gardou <[email protected]> CommitDate: Thu Feb 4 16:37:06 2021 +0100 [WINESYNC] d3dx9: Validate state operation in d3dx_parse_state(). Signed-off-by: Paul Gofman <[email protected]> Signed-off-by: Matteo Bruni <[email protected]> Signed-off-by: Alexandre Julliard <[email protected]> wine commit id 2b5b069dd70ba328dc0ce660861ad802feae912c by Paul Gofman <[email protected]> --- dll/directx/wine/d3dx9_36/effect.c | 6 ++++++ sdk/tools/winesync/d3dx9.cfg | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/dll/directx/wine/d3dx9_36/effect.c b/dll/directx/wine/d3dx9_36/effect.c index 8670daa81b2..32e64daed0f 100644 --- a/dll/directx/wine/d3dx9_36/effect.c +++ b/dll/directx/wine/d3dx9_36/effect.c @@ -5568,6 +5568,12 @@ static HRESULT d3dx_parse_state(struct d3dx_effect *effect, struct d3dx_state *s state->type = ST_CONSTANT; read_dword(ptr, &state->operation); + if (state->operation >= ARRAY_SIZE(state_table)) + { + WARN("Unknown state operation %u.\n", state->operation); + return D3DERR_INVALIDCALL; + } + TRACE("Operation: %#x (%s)\n", state->operation, state_table[state->operation].name); read_dword(ptr, &state->index); diff --git a/sdk/tools/winesync/d3dx9.cfg b/sdk/tools/winesync/d3dx9.cfg index 7ebb6f89bd1..ed3974a73d2 100644 --- a/sdk/tools/winesync/d3dx9.cfg +++ b/sdk/tools/winesync/d3dx9.cfg @@ -15,4 +15,4 @@ files: {include/d3dx9.h: sdk/include/dxsdk/d3dx9.h, include/d3dx9anim.h: sdk/inc include/d3dx9mesh.h: sdk/include/dxsdk/d3dx9mesh.h, include/d3dx9of.h: sdk/include/dxsdk/d3dx9of.h, include/d3dx9shader.h: sdk/include/dxsdk/d3dx9shader.h, include/d3dx9shape.h: sdk/include/dxsdk/d3dx9shape.h, include/d3dx9tex.h: sdk/include/dxsdk/d3dx9tex.h, include/d3dx9xof.h: sdk/include/dxsdk/d3dx9xof.h} -tags: {wine: cfc533b40d2d1426a8f05501152b28aa1ec78f07} +tags: {wine: 2b5b069dd70ba328dc0ce660861ad802feae912c}
