From 83a9baa797b2b77ed93392ce334a996d1bc5d131 Mon Sep 17 00:00:00 2001 From: Leonard Hecker Date: Wed, 10 Jul 2024 00:07:01 +0200 Subject: [PATCH] AtlasEngine: Fix a buffer overrun (#17536) The strided `memcpy` between buffers failed to account for situations where the destination stride is smaller than the source stride. The solution is to only copy as many bytes as are in each row. ## Validation Steps Performed Even with AppVerifier the issue could not be reproduced. Adding an `assert(srcStride <= mapped.RowPitch)`, however, did trap the bug when WARP is used while BackendD3D is force-enabled. (cherry picked from commit ae8c868a1c3d66dcee66e4e854b5285a4cae7040) Service-Card-Id: 92972720 Service-Version: 1.21 --- src/renderer/atlas/BackendD3D.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/renderer/atlas/BackendD3D.cpp b/src/renderer/atlas/BackendD3D.cpp index e7d05e0cbdb..7e8d5fc91af 100644 --- a/src/renderer/atlas/BackendD3D.cpp +++ b/src/renderer/atlas/BackendD3D.cpp @@ -1062,12 +1062,13 @@ void BackendD3D::_uploadBackgroundBitmap(const RenderingPayload& p) auto src = std::bit_cast(p.backgroundBitmap.data()); const auto srcEnd = std::bit_cast(p.backgroundBitmap.data() + p.backgroundBitmap.size()); + const auto srcWidth = p.s->viewportCellCount.x * sizeof(u32); const auto srcStride = p.colorBitmapRowStride * sizeof(u32); auto dst = static_cast(mapped.pData); while (src < srcEnd) { - memcpy(dst, src, srcStride); + memcpy(dst, src, srcWidth); src += srcStride; dst += mapped.RowPitch; }