ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-08-30 19:26:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

should have read msdn one more time for D3DParseUnknownCommand vaild command return sizeof of the struct * number of struct + 4 bytes, so it point to the end of the buffer.

Browse Source 
svn path=/trunk/; revision=24601
This commit is contained in:
Magnus Olsen
2006-10-22 10:43:36 +00:00
parent b780943388
commit 98ae58da2b
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/dll/directx/ddraw/main.c
+12 -14
View File
@@ -145,36 +145,34 @@ D3DParseUnknownCommand( LPVOID lpCmd,
DWORD retCode = D3DERR_COMMAND_UNPARSED;
/* prevent it crash if null pointer are being sent */
if (lpCmd == NULL) || (lpRetCmd == NULL) )
if ( (lpCmd == NULL) || (lpRetCmd == NULL) )
{
return E_FAIL;
}
*lpRetCmd = lpCmd;
/* check for vaild command, only 3 command is vaild */
if (dp2command->bCommand == D3DDP2OP_VIEWPORTINFO)
{
*(PBYTE)lpRetCmd += ((dp2command->wStateCount * sizeof(D3DHAL_DP2VIEWPORTINFO)) + sizeof(D3DHAL_DP2POINTS));
{
/* dp2command->wStateCount * sizeof D3DHAL_DP2VIEWPORTINFO + 4 bytes */
*(PBYTE)lpRetCmd += ((dp2command->wStateCount * sizeof(D3DHAL_DP2VIEWPORTINFO)) + sizeof(ULONG_PTR));
retCode = 0;
}
else if (dp2command->bCommand == D3DDP2OP_WINFO)
{
*(PBYTE)lpRetCmd += (dp2command->wStateCount * sizeof(D3DHAL_DP2WINFO)) + sizeof(D3DHAL_DP2POINTS);
{
/* dp2command->wStateCount * sizeof D3DHAL_DP2WINFO + 4 bytes */
*(PBYTE)lpRetCmd += (dp2command->wStateCount * sizeof(D3DHAL_DP2WINFO)) + sizeof(ULONG_PTR);
retCode = 0;
}
else if (dp2command->bCommand == 0x0d)
{
/* math
*lpRetCmd = lpCmd + (wStateCount * sizeof( ? ) + sizeof(D3DHAL_DP2POINTS)
*/
*(PBYTE)lpRetCmd += ((dp2command->wStateCount * dp2command->bReserved) + sizeof(D3DHAL_DP2POINTS));
{
/* dp2command->wStateCount * how many wStateCount ? + 4 bytes */
*(PBYTE)lpRetCmd += ((dp2command->wStateCount * dp2command->bReserved) + sizeof(ULONG_PTR));
retCode = 0;
}
/* error code */
/* set error code for command 0 to 3, 8 and 15 to 255 */
else if ( (dp2command->bCommand <= D3DDP2OP_INDEXEDTRIANGLELIST) || // dp2command->bCommand <= with 0 to 3
(dp2command->bCommand == D3DDP2OP_RENDERSTATE) || // dp2command->bCommand == with 8
(dp2command->bCommand >= D3DDP2OP_LINELIST) ) // dp2command->bCommand >= with 15 to 255