Skip to content

A
angle
Commit 6bbd095a by Jamie Madill
Options

D3D11: Fix OOB write in Blit11.

This could happen for specific values of the 'dest' target. Bug: chromium:1219082 (cherry picked from commit bd797f75) Change-Id: I1895d2c614269f79376f49dbd87e279ca52c00a4 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2994730Reviewed-by: 's avatarJamie Madill <jmadill@chromium.org>
parent 10b8a6d1
Showing with 3 additions and 2 deletions
src/libANGLE/renderer/d3d/d3d11/Blit11.cpp
...@@ -60,12 +60,13 @@ void StretchedBlitNearest_RowByRow(const gl::Box &sourceArea, ...@@ -60,12 +60,13 @@ void StretchedBlitNearest_RowByRow(const gl::Box &sourceArea,
uint8_t *destData) uint8_t *destData)
{ {
int srcHeightSubOne = (sourceArea.height - 1); int srcHeightSubOne = (sourceArea.height - 1);
size_t copySize = pixelSize * destArea.width; size_t copySize = pixelSize * clippedDestArea.width;
size_t srcOffset = sourceArea.x * pixelSize; size_t srcOffset = sourceArea.x * pixelSize;
size_t destOffset = destArea.x * pixelSize; size_t destOffset = clippedDestArea.x * pixelSize;
for (int y = clippedDestArea.y; y < clippedDestArea.y + clippedDestArea.height; y++) for (int y = clippedDestArea.y; y < clippedDestArea.y + clippedDestArea.height; y++)
{ {
// TODO: Fix divide by zero when height == 1. http://anglebug.com/6099
float yPerc = static_cast<float>(y - destArea.y) / (destArea.height - 1); float yPerc = static_cast<float>(y - destArea.y) / (destArea.height - 1);
// Interpolate using the original source rectangle to determine which row to sample from // Interpolate using the original source rectangle to determine which row to sample from
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment