Henri Verbeet : d3drm: Also validate face indices against the vertex count in load_mesh_data() ( Valgrind).

[Alexandre Julliard]

Module: wine
Branch: master
Commit: e723d2a0793b23ad527b681d01ecbb39af757c6b
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=e723d2a0793b23ad527b681d01...

Author: Henri Verbeet 
Date:   Mon May  4 13:21:31 2015 +0200

d3drm: Also validate face indices against the vertex count in load_mesh_data() (Valgrind).

---

dlls/d3drm/meshbuilder.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dlls/d3drm/meshbuilder.c b/dlls/d3drm/meshbuilder.c
index c24d9dc..8bd5131 100644
--- a/dlls/d3drm/meshbuilder.c
+++ b/dlls/d3drm/meshbuilder.c
@@ -1368,7 +1368,10 @@ HRESULT load_mesh_data(IDirect3DRMMeshBuilder3 *iface, IDirectXFileData *pData,
         if (!This->nb_normals)
         {
             /* Compute face normal */
-            if (nb_face_indexes > 2)
+            if (nb_face_indexes > 2
+                    && faces_vertex_idx_ptr[0] < This->nb_vertices
+                    && faces_vertex_idx_ptr[1] < This->nb_vertices
+                    && faces_vertex_idx_ptr[2] < This->nb_vertices)
             {
                 D3DVECTOR a, b;