Skip to content

Commit 83a9baa

Browse files
lheckerDHowett
authored andcommitted
AtlasEngine: Fix a buffer overrun (#17536)
The strided `memcpy` between buffers failed to account for situations where the destination stride is smaller than the source stride. The solution is to only copy as many bytes as are in each row. ## Validation Steps Performed Even with AppVerifier the issue could not be reproduced. Adding an `assert(srcStride <= mapped.RowPitch)`, however, did trap the bug when WARP is used while BackendD3D is force-enabled. (cherry picked from commit ae8c868) Service-Card-Id: 92972720 Service-Version: 1.21
1 parent 5a99621 commit 83a9baa

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/renderer/atlas/BackendD3D.cpp

+2-1
Original file line numberDiff line numberDiff line change
@@ -1062,12 +1062,13 @@ void BackendD3D::_uploadBackgroundBitmap(const RenderingPayload& p)
10621062

10631063
auto src = std::bit_cast<const char*>(p.backgroundBitmap.data());
10641064
const auto srcEnd = std::bit_cast<const char*>(p.backgroundBitmap.data() + p.backgroundBitmap.size());
1065+
const auto srcWidth = p.s->viewportCellCount.x * sizeof(u32);
10651066
const auto srcStride = p.colorBitmapRowStride * sizeof(u32);
10661067
auto dst = static_cast<char*>(mapped.pData);
10671068

10681069
while (src < srcEnd)
10691070
{
1070-
memcpy(dst, src, srcStride);
1071+
memcpy(dst, src, srcWidth);
10711072
src += srcStride;
10721073
dst += mapped.RowPitch;
10731074
}

0 commit comments

Comments
 (0)