Skip to content

d2d1: Fix out-of-bound array access.

Yuxuan Shui requested to merge yshui/wine:d2d1-oob into master

d2d_fp_fast_expansion_sum_zeroelim contains many instances of this pattern:

    if (a_idx < a_len)
    {
        use(a_curr);
        a_curr = a[++a_idx];
    }

Here if a_idx is already a_len - 1, a[++a_idx] reads past the last element of a.

Merge request reports

Loading