Changeset 81211 in vbox for trunk/src/VBox/Devices/Graphics/shaderlib/shader.c

Timestamp:

Oct 10, 2019 12:17:52 PM (5 years ago)

Author:

vboxsync

Message:

More validation of a shader bytecode, bugref:9520

File:

• trunk/src/VBox/Devices/Graphics/shaderlib/shader.c (modified) (4 diffs)

trunk/src/VBox/Devices/Graphics/shaderlib/shader.c

@@ -335 +335 @@
 }
 
-static void shader_record_register_usage(IWineD3DBaseShaderImpl *shader, struct shader_reg_maps *reg_maps,
+static HRESULT shader_record_register_usage(IWineD3DBaseShaderImpl *shader, struct shader_reg_maps *reg_maps,
         const struct wined3d_shader_register *reg, enum wined3d_shader_type shader_type)
 {
@@ -365 +365 @@
                 else
                 {
-                    ((IWineD3DPixelShaderImpl *)shader)->input_reg_used[reg->idx] = TRUE;
+                    unsigned int reg_idx = reg->idx;
+                    
+                    if (reg_idx >= MAX_REG_INPUT)
+                    {
+                        ERR("Invalid input register index %d.\n", reg_idx);
+                        return E_INVALIDARG;
+                    }
+                    
+                    ((IWineD3DPixelShaderImpl *)shader)->input_reg_used[reg_idx] = TRUE;
                 }
             }
@@ -421 +429 @@
             break;
     }
+
+    return S_OK;
 }
 
@@ -660 +670 @@
                 struct wined3d_shader_src_param dst_rel_addr;
                 struct wined3d_shader_dst_param dst_param;
+                HRESULT hr;
 
                 fe->shader_read_dst_param(fe_data, &ptr, &dst_param, &dst_rel_addr);
 
-                shader_record_register_usage(shader, reg_maps, &dst_param.reg, shader_version.type);
+                hr = shader_record_register_usage(shader, reg_maps, &dst_param.reg, shader_version.type);
+                if (FAILED(hr))
+                {
+                    ERR("shader_record_register_usage failed.\n");
+                    return hr;
+                }
 
                 /* WINED3DSPR_TEXCRDOUT is the same as WINED3DSPR_OUTPUT. _OUTPUT can be > MAX_REG_TEXCRD and