amacocian/gMod
1
0
Fork 0
mirror of https://github.com/gwdevhub/gMod.git synced 2026-07-15 15:09:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix surface ref leak and double-release in HashTexture2D multisample path

Browse Source 
The D3DPOOL_DEFAULT multisample branch aliased pSurfaceLevel_orig onto
pResolvedSurface, leaking the GetSurfaceLevel reference and releasing the
resolved surface twice (use-after-free). Track the read source in a separate
non-owning pointer so each surface is released exactly once on every path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Marc
2026-06-08 17:14:17 +00:00
parent b04b4583f4
commit 2b87e0e53a
1 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/D3D9Hooks.cpp
+19 -7
View File
@@ -416,6 +416,11 @@ namespace {
return {};
}
// The surface GetRenderTargetData reads from: either the level itself, or a
// non-multisampled resolve of it. Non-owning; pSurfaceLevel_orig and
// pResolvedSurface each own a ref and are released exactly once below.
IDirect3DSurface9* pCopySource = pSurfaceLevel_orig;
if (desc.MultiSampleType != D3DMULTISAMPLE_NONE) {
if (D3D_OK != device->CreateRenderTarget(desc.Width, desc.Height, desc.Format, D3DMULTISAMPLE_NONE, 0, FALSE, &pResolvedSurface, nullptr)) {
pSurfaceLevel_orig->Release();
@@ -423,31 +428,39 @@ namespace {
return {};
}
if (D3D_OK != device->StretchRect(pSurfaceLevel_orig, nullptr, pResolvedSurface, nullptr, D3DTEXF_NONE)) {
pResolvedSurface->Release();
pResolvedSurface = nullptr;
pSurfaceLevel_orig->Release();
Warning("GetTextureHash(2D) Failed: StretchRect (D3DPOOL_DEFAULT)\n");
return {};
}
pSurfaceLevel_orig = pResolvedSurface;
pCopySource = pResolvedSurface;
}
if (D3D_OK != device->CreateOffscreenPlainSurface(desc.Width, desc.Height, desc.Format, D3DPOOL_SYSTEMMEM, &pOffscreenSurface, nullptr)) {
pSurfaceLevel_orig->Release();
if (pResolvedSurface != nullptr) pResolvedSurface->Release();
pSurfaceLevel_orig->Release();
Warning("GetTextureHash(2D) Failed: CreateOffscreenPlainSurface (D3DPOOL_DEFAULT)\n");
return {};
}
if (D3D_OK != device->GetRenderTargetData(pSurfaceLevel_orig, pOffscreenSurface)) {
pSurfaceLevel_orig->Release();
if (pResolvedSurface != nullptr) pResolvedSurface->Release();
if (D3D_OK != device->GetRenderTargetData(pCopySource, pOffscreenSurface)) {
pOffscreenSurface->Release();
if (pResolvedSurface != nullptr) pResolvedSurface->Release();
pSurfaceLevel_orig->Release();
Warning("GetTextureHash(2D) Failed: GetRenderTargetData (D3DPOOL_DEFAULT)\n");
return {};
}
// Copy is done; both source surfaces are finished with. Null pResolvedSurface
// so the shared cleanup below treats this as the pOffscreenSurface case.
if (pResolvedSurface != nullptr) {
pResolvedSurface->Release();
pResolvedSurface = nullptr;
}
pSurfaceLevel_orig->Release();
if (pOffscreenSurface->LockRect(&d3dlr, nullptr, D3DLOCK_READONLY) != D3D_OK) {
if (pResolvedSurface != nullptr) pResolvedSurface->Release();
pOffscreenSurface->Release();
Warning("GetTextureHash(2D) Failed: LockRect (D3DPOOL_DEFAULT)\n");
return {};
@@ -472,7 +485,6 @@ namespace {
if (pOffscreenSurface != nullptr) {
pOffscreenSurface->UnlockRect();
pOffscreenSurface->Release();
if (pResolvedSurface != nullptr) pResolvedSurface->Release();
}
else if (pResolvedSurface != nullptr) {
pResolvedSurface->UnlockRect();