From a4143be052db6b98b8cd03090fdcb0d5be4444ae Mon Sep 17 00:00:00 2001 From: jp9000 Date: Fri, 23 Dec 2016 07:39:09 -0800 Subject: [PATCH] win-capture: Fix possible access of array beyond size If the backbuffer count is larger than 3, it could still try to assign backbuffers to pointers beyond the variable's array size when calling swap->GetBuffer. --- plugins/win-capture/graphics-hook/d3d12-capture.cpp | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/plugins/win-capture/graphics-hook/d3d12-capture.cpp b/plugins/win-capture/graphics-hook/d3d12-capture.cpp index 01c31b32f..35995e95f 100644 --- a/plugins/win-capture/graphics-hook/d3d12-capture.cpp +++ b/plugins/win-capture/graphics-hook/d3d12-capture.cpp @@ -70,12 +70,6 @@ static bool create_d3d12_tex(ID3D12Resource *backbuffer[3], UINT count) if (!count) return false; - if (count > 3) { - hlog("Somehow it's using more than 3 backbuffers. " - "Not sure why anyone would do that."); - count = 3; - } - data.backbuffer_count = count; for (UINT i = 0; i < count; i++) { @@ -246,6 +240,13 @@ static inline bool d3d12_init_format(IDXGISwapChain *swap, HWND &window, count = desc.SwapEffect == DXGI_SWAP_EFFECT_DISCARD ? 1 : desc.BufferCount; + if (count > 3) { + hlog("Somehow it's using more than the max backbuffers. " + "Not sure why anyone would do that."); + count = 1; + data.dxgi_1_4 = false; + } + for (UINT i = 0; i < count; i++) { hr = swap->GetBuffer(i, __uuidof(ID3D12Resource), (void**)&backbuffer[i]);