From 058c7db80b074fa52aaa504329ee69cf25a516e3 Mon Sep 17 00:00:00 2001 From: Pokechu22 Date: Fri, 11 Dec 2020 23:04:32 -0800 Subject: Software: Fix out of bounds accesses in CopyRegion Fixes issue 11393. The problem is that left and top make no sense for a width by height array; they only make sense in a larger array where from which a smaller part is extracted. Thus, the overall size of the array is provided to CopyRegion in addition to the sub-region. EncodeXFB already handles the extraction, so CopyRegion's only use there is to resize the image (and thus no sub-region is provided). --- Source/Core/VideoBackends/Software/EfbInterface.cpp | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) (limited to 'Source/Core/VideoBackends/Software/EfbInterface.cpp') diff --git a/Source/Core/VideoBackends/Software/EfbInterface.cpp b/Source/Core/VideoBackends/Software/EfbInterface.cpp index 8ef62d5b03..acf82fc317 100644 --- a/Source/Core/VideoBackends/Software/EfbInterface.cpp +++ b/Source/Core/VideoBackends/Software/EfbInterface.cpp @@ -634,17 +634,13 @@ void EncodeXFB(u8* xfb_in_ram, u32 memory_stride, const MathUtil::Rectangle src_ptr += memory_stride; } - auto dest_rect = - MathUtil::Rectangle{source_rect.left, source_rect.top, source_rect.right, - static_cast(static_cast(source_rect.bottom) * y_scale)}; + const int src_width = source_rect.GetWidth(); + const int src_height = source_rect.GetHeight(); + const int dst_width = src_width; + const int dst_height = src_height * y_scale; - const std::size_t destination_size = dest_rect.GetWidth() * dest_rect.GetHeight() * 2; - static std::vector destination; - destination.resize(dest_rect.GetWidth() * dest_rect.GetHeight()); - - SW::CopyRegion(source.data(), source_rect, destination.data(), dest_rect); - - memcpy(xfb_in_ram, destination.data(), destination_size); + SW::CopyRegion(source.data(), src_width, src_height, reinterpret_cast(xfb_in_ram), + dst_width, dst_height); } bool ZCompare(u16 x, u16 y, u32 z) -- cgit v1.2.3