jp9000/obs-studio
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

win-capture: Fix possible access of array beyond size

Browse Source 
If the backbuffer count is larger than 3, it could still try to assign
backbuffers to pointers beyond the variable's array size when calling
swap->GetBuffer.
This commit is contained in:
jp9000
2016-12-23 07:39:09 -08:00
parent b276b1633e
commit a4143be052
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
plugins/win-capture/graphics-hook/d3d12-capture.cpp
View File

@@ -70,12 +70,6 @@ static bool create_d3d12_tex(ID3D12Resource *backbuffer[3], UINT count)
if (!count)
return false;
if (count > 3) {
hlog("Somehow it's using more than 3 backbuffers. "
"Not sure why anyone would do that.");
count = 3;
}
data.backbuffer_count = count;
for (UINT i = 0; i < count; i++) {
@@ -246,6 +240,13 @@ static inline bool d3d12_init_format(IDXGISwapChain *swap, HWND &window,
count = desc.SwapEffect == DXGI_SWAP_EFFECT_DISCARD
? 1 : desc.BufferCount;
if (count > 3) {
hlog("Somehow it's using more than the max backbuffers. "
"Not sure why anyone would do that.");
count = 1;
data.dxgi_1_4 = false;
}
for (UINT i = 0; i < count; i++) {
hr = swap->GetBuffer(i, __uuidof(ID3D12Resource),
(void**)&backbuffer[i]);