piwalker/dolphin
1
0
Fork 0
mirror of https://github.com/dolphin-emu/dolphin.git synced 2025-07-21 21:30:19 -06:00
Code Issues Packages Projects Releases Wiki Activity

Software: Fix out of bounds accesses in CopyRegion

Browse Source 
Fixes issue 11393.

The problem is that left and top make no sense for a width by height array; they only make sense in a larger array where from which a smaller part is extracted.  Thus, the overall size of the array is provided to CopyRegion in addition to the sub-region.  EncodeXFB already handles the extraction, so CopyRegion's only use there is to resize the image (and thus no sub-region is provided).
This commit is contained in:
Pokechu22
2020-12-11 23:04:32 -08:00
parent 089250fde6
commit 058c7db80b
3 changed files with 43 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
Source/Core/VideoBackends/Software/EfbInterface.cpp
View File

@ -634,17 +634,13 @@ void EncodeXFB(u8* xfb_in_ram, u32 memory_stride, const MathUtil::Rectangle<int>
src_ptr += memory_stride;
}
auto dest_rect =
MathUtil::Rectangle<int>{source_rect.left, source_rect.top, source_rect.right,
static_cast<int>(static_cast<float>(source_rect.bottom) * y_scale)};
const int src_width = source_rect.GetWidth();
const int src_height = source_rect.GetHeight();
const int dst_width = src_width;
const int dst_height = src_height * y_scale;
const std::size_t destination_size = dest_rect.GetWidth() * dest_rect.GetHeight() * 2;
static std::vector<yuv422_packed> destination;
destination.resize(dest_rect.GetWidth() * dest_rect.GetHeight());
SW::CopyRegion(source.data(), source_rect, destination.data(), dest_rect);
memcpy(xfb_in_ram, destination.data(), destination_size);
SW::CopyRegion(source.data(), src_width, src_height, reinterpret_cast<yuv422_packed*>(xfb_in_ram),
dst_width, dst_height);
}
bool ZCompare(u16 x, u16 y, u32 z)