Mirrored_Repos/LookingGlass
1
0
Fork 0
mirror of https://github.com/gnif/LookingGlass.git synced 2026-08-24 16:11:31 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

[common] rects: validate copy geometry

Browse Source
This commit is contained in:
Geoffrey McRae
2026-08-24 12:59:55 +10:00
parent b78b92a53f
commit 8336a27192
4 changed files with 124 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
host/platform/Windows/capture/D12/d12.c
View File

@@ -1016,6 +1016,13 @@ static CaptureResult d12_getFrame(
if (!*dst)
goto exit;
const size_t frameHeight = this->dstFormat.desc.Height;
if (!this->pitch || !frameHeight ||
frameHeight > maxFrameSize / this->pitch ||
frameHeight * this->pitch > UINT_LEAST32_MAX)
goto exit;
const size_t frameSize = frameHeight * this->pitch;
// place a fence into the queue
DEBUG_TRACE("d12_backendSync");
result = d12_backendSync(this->backend,
@@ -1210,18 +1217,19 @@ static CaptureResult d12_getFrame(
{
if (rectCount == 0)
{
framebuffer_write(frameBuffer, map,
this->pitch * this->dstFormat.desc.Height);
framebuffer_write(frameBuffer, map, frameSize);
}
else
{
/* copy all the rects */
rectsBufferToFramebuffer(allRects, rectCount, this->bpp, frameBuffer,
this->pitch, this->dstFormat.desc.Height, map, this->pitch);
if (!rectsBufferToFramebuffer(allRects, rectCount, this->bpp,
frameBuffer, this->pitch, this->dstFormat.desc.Height,
map, this->pitch))
framebuffer_write(frameBuffer, map,
frameSize);
// signal the frame is complete
framebuffer_set_write_ptr(frameBuffer,
this->dstFormat.desc.Height * this->pitch);
framebuffer_set_write_ptr(frameBuffer, frameSize);
}
}
else

14
host/platform/Windows/capture/DXGI/src/dxgi.c
View File

@@ -1551,13 +1551,19 @@ static CaptureResult dxgi_getFrame(
scaledDamageRects[i] = rect;
}
rectsBufferToFramebuffer(scaledDamageRects, damage->count, this->bpp, frame,
this->pitch, this->dataHeight, tex->map, this->pitch);
if (!rectsBufferToFramebuffer(scaledDamageRects, damage->count,
this->bpp, frame, this->pitch, this->dataHeight,
tex->map, this->pitch))
framebuffer_write(frame, tex->map,
this->pitch * this->dataHeight);
}
else
{
rectsBufferToFramebuffer(damage->rects, damage->count, this->bpp, frame,
this->pitch, this->dataHeight, tex->map, this->pitch);
if (!rectsBufferToFramebuffer(damage->rects, damage->count,
this->bpp, frame, this->pitch, this->dataHeight,
tex->map, this->pitch))
framebuffer_write(frame, tex->map,
this->pitch * this->dataHeight);
}
}
}