Skip to content

Commit a11b37e

Browse files
lheckerDHowett
authored andcommitted
AtlasEngine: Fix a buffer overrun (#17536)
The strided `memcpy` between buffers failed to account for situations where the destination stride is smaller than the source stride. The solution is to only copy as many bytes as are in each row. ## Validation Steps Performed Even with AppVerifier the issue could not be reproduced. Adding an `assert(srcStride <= mapped.RowPitch)`, however, did trap the bug when WARP is used while BackendD3D is force-enabled. (cherry picked from commit ae8c868) Service-Card-Id: 92972719 Service-Version: 1.20
1 parent 58073ce commit a11b37e

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/renderer/atlas/BackendD3D.cpp

+2-1
Original file line numberDiff line numberDiff line change
@@ -1068,12 +1068,13 @@ void BackendD3D::_uploadBackgroundBitmap(const RenderingPayload& p)
10681068

10691069
auto src = std::bit_cast<const char*>(p.backgroundBitmap.data());
10701070
const auto srcEnd = std::bit_cast<const char*>(p.backgroundBitmap.data() + p.backgroundBitmap.size());
1071+
const auto srcWidth = p.s->viewportCellCount.x * sizeof(u32);
10711072
const auto srcStride = p.colorBitmapRowStride * sizeof(u32);
10721073
auto dst = static_cast<char*>(mapped.pData);
10731074

10741075
while (src < srcEnd)
10751076
{
1076-
memcpy(dst, src, srcStride);
1077+
memcpy(dst, src, srcWidth);
10771078
src += srcStride;
10781079
dst += mapped.RowPitch;
10791080
}

0 commit comments

Comments
 (0)