Explorar o código

win-capture: Fix possible access of array beyond size

If the backbuffer count is larger than 3, it could still try to assign
backbuffers to pointers beyond the variable's array size when calling
swap->GetBuffer.
jp9000 %!s(int64=9) %!d(string=hai) anos
pai
achega
a4143be052
Modificáronse 1 ficheiros con 7 adicións e 6 borrados
  1. 7 6
      plugins/win-capture/graphics-hook/d3d12-capture.cpp

+ 7 - 6
plugins/win-capture/graphics-hook/d3d12-capture.cpp

@@ -70,12 +70,6 @@ static bool create_d3d12_tex(ID3D12Resource *backbuffer[3], UINT count)
 	if (!count)
 		return false;
 
-	if (count > 3) {
-		hlog("Somehow it's using more than 3 backbuffers.  "
-				"Not sure why anyone would do that.");
-		count = 3;
-	}
-
 	data.backbuffer_count = count;
 
 	for (UINT i = 0; i < count; i++) {
@@ -246,6 +240,13 @@ static inline bool d3d12_init_format(IDXGISwapChain *swap, HWND &window,
 	count = desc.SwapEffect == DXGI_SWAP_EFFECT_DISCARD
 		? 1 : desc.BufferCount;
 
+	if (count > 3) {
+		hlog("Somehow it's using more than the max backbuffers.  "
+				"Not sure why anyone would do that.");
+		count = 1;
+		data.dxgi_1_4 = false;
+	}
+
 	for (UINT i = 0; i < count; i++) {
 		hr = swap->GetBuffer(i, __uuidof(ID3D12Resource),
 				(void**)&backbuffer[i]);