Mirrored_Repos/LookingGlass
1
0
Fork 0
mirror of https://github.com/gnif/LookingGlass.git synced 2026-08-25 08:22:36 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

[host] d12: stop invalid pointer shape copies

Browse Source
This commit is contained in:
Geoffrey McRae
2026-08-24 13:24:21 +10:00
parent 4e75351c78
commit 0062db4eef
2 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
host/platform/Windows/capture/D12/backend/dd.c
View File

@@ -78,6 +78,7 @@ typedef struct DDInstance
void * shapeBuffer; void * shapeBuffer;
unsigned shapeBufferSize; unsigned shapeBufferSize;
unsigned shapeSize;
} }
DDInstance; DDInstance;
@@ -424,7 +425,7 @@ retry:
&pointer, frameInfo.PointerShapeBufferSize, &postPointer); &pointer, frameInfo.PointerShapeBufferSize, &postPointer);
if (postPointer) if (postPointer)
d12_updatePointer(&pointer, this->shapeBuffer, this->shapeBufferSize); d12_updatePointer(&pointer, this->shapeBuffer, this->shapeSize);
// if this was not a frame update, go back and try again // if this was not a frame update, go back and try again
if (frameInfo.LastPresentTime.QuadPart == 0) if (frameInfo.LastPresentTime.QuadPart == 0)
@@ -714,6 +715,13 @@ retry:
return; return;
} }
if (!s || s > this->shapeBufferSize || !info.Height || !info.Pitch ||
(size_t)info.Height > (size_t)s / info.Pitch)
{
DEBUG_ERROR("Desktop duplication returned an invalid pointer shape");
return;
}
switch(info.Type) switch(info.Type)
{ {
case DXGI_OUTDUPL_POINTER_SHAPE_TYPE_COLOR: case DXGI_OUTDUPL_POINTER_SHAPE_TYPE_COLOR:
@@ -739,6 +747,7 @@ retry:
pointer->pitch = info.Pitch; pointer->pitch = info.Pitch;
pointer->hx = info.HotSpot.x; pointer->hx = info.HotSpot.x;
pointer->hy = info.HotSpot.y; pointer->hy = info.HotSpot.y;
this->shapeSize = s;
*changed = true; *changed = true;
} }

10
host/platform/Windows/capture/D12/d12.c
View File

@@ -1613,9 +1613,13 @@ void d12_updatePointer(CapturePointer * pointer, void * shape, size_t shapeSize)
DEBUG_ERROR("Failed to obtain a buffer for the pointer shape"); DEBUG_ERROR("Failed to obtain a buffer for the pointer shape");
pointer->shapeUpdate = false; pointer->shapeUpdate = false;
} }
else if (!shape || !shapeSize || shapeSize > dstSize)
size_t copySize = min(dstSize, shapeSize); {
memcpy(dst, shape, copySize); DEBUG_ERROR("Pointer shape does not fit in the destination buffer");
pointer->shapeUpdate = false;
}
else
memcpy(dst, shape, shapeSize);
} }
this->postPointerBufferFn(pointer); this->postPointerBufferFn(pointer);