D3D11: Fix OOB write in Blit11.

This could happen for specific values of the 'dest' target. Bug: chromium:1219082 (cherry picked from commit bd797f75) Change-Id: I1895d2c614269f79376f49dbd87e279ca52c00a4 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2994730Reviewed-by: Jamie Madill <jmadill@chromium.org>

D3D11: Fix OOB write in Blit11.
6bbd095a · Jamie Madill · 10b8a6d1 · 6bbd095a
Commit 6bbd095a authored Jun 14, 2021 by Jamie Madill
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 2 deletions

Blit11.cpp src/libANGLE/renderer/d3d/d3d11/Blit11.cpp +3 -2

No files found.
--- a/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp
+++ b/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp
@@ -60,12 +60,13 @@ void StretchedBlitNearest_RowByRow(const gl::Box &sourceArea,
                                   uint8_t *destData)
 {
    int srcHeightSubOne = (sourceArea.height - 1);
-    size_t copySize     = pixelSize * destArea.width;
+    size_t copySize     = pixelSize * clippedDestArea.width;
    size_t srcOffset    = sourceArea.x * pixelSize;
-    size_t destOffset   = destArea.x * pixelSize;
+    size_t destOffset   = clippedDestArea.x * pixelSize;

    for (int y = clippedDestArea.y; y < clippedDestArea.y + clippedDestArea.height; y++)
    {
+        // TODO: Fix divide by zero when height == 1. http://anglebug.com/6099
        float yPerc = static_cast<float>(y - destArea.y) / (destArea.height - 1);

        // Interpolate using the original source rectangle to determine which row to sample from