| commit | e6c6be1cf75db1cf58f39d170ab6a7f3d7bc5663 | |
| author | Paul Gofman <gofmanp@gmail.com> | |
| Tue, 18 Dec 2018 16:57:22 +0000 (18 19:57 +0300) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Thu, 20 Dec 2018 19:19:10 +0000 (20 20:19 +0100) | ||
| tree | e6fbf052a7466c7e9e1119f6ede23f7bff42cdef | treesnapshot (tar.gz zip) |
| parent | cc743f8e6cee1ddfbda5a008c906d32277146733 | commitdiff |
d3d9: Fix crash in d3d9_vertexbuffer_Release().
If there is no draw buffer then buffer pointer gets freed in
wined3d_buffer_decref() via d3d9_vertexbuffer_wined3d_parent_ops
and consequent check for buffer->draw_buffer results in freed
memory access.
Signed-off-by: Paul Gofman <gofmanp@gmail.com>
Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
If there is no draw buffer then buffer pointer gets freed in
wined3d_buffer_decref() via d3d9_vertexbuffer_wined3d_parent_ops
and consequent check for buffer->draw_buffer results in freed
memory access.
Signed-off-by: Paul Gofman <gofmanp@gmail.com>
Signed-off-by: Henri Verbeet <hverbeet@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
| dlls/d3d9/buffer.c | diffblobblamehistory |