From cc16e0d2de47bc6a34039f6cc8d261d94241edf3 Mon Sep 17 00:00:00 2001 From: Henri Verbeet Date: Tue, 25 Jul 2017 14:26:00 +0200 Subject: [PATCH] wined3d: Validate vertex shader input signature register indices (AFL). Signed-off-by: Henri Verbeet Signed-off-by: Alexandre Julliard --- dlls/wined3d/shader.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/dlls/wined3d/shader.c b/dlls/wined3d/shader.c index d9504ef9ceb..8ed2cb9ed97 100644 --- a/dlls/wined3d/shader.c +++ b/dlls/wined3d/shader.c @@ -1684,14 +1684,22 @@ static HRESULT shader_get_registers_used(struct wined3d_shader *shader, const st { for (i = 0; i < input_signature->element_count; ++i) { - reg_maps->input_registers |= 1u << input_signature->elements[i].register_idx; - if (shader_version.type == WINED3D_SHADER_TYPE_PIXEL) + if (shader_version.type == WINED3D_SHADER_TYPE_VERTEX) + { + if (input_signature->elements[i].register_idx >= ARRAY_SIZE(shader->u.vs.attributes)) + { + WARN("Invalid input signature register index %u.\n", input_signature->elements[i].register_idx); + return WINED3DERR_INVALIDCALL; + } + } + else if (shader_version.type == WINED3D_SHADER_TYPE_PIXEL) { if (input_signature->elements[i].sysval_semantic == WINED3D_SV_POSITION) reg_maps->vpos = 1; else if (input_signature->elements[i].sysval_semantic == WINED3D_SV_IS_FRONT_FACE) reg_maps->usesfacing = 1; } + reg_maps->input_registers |= 1u << input_signature->elements[i].register_idx; } } else if (!input_signature->elements && reg_maps->input_registers) -- 2.11.4.GIT