From 04474b761be0732f3e1fae813935fc3bcd2bab65 Mon Sep 17 00:00:00 2001
From: Georg Lehmann <dadschoorse@gmail.com>
Date: Thu, 19 Aug 2021 18:07:10 +0200
Subject: [PATCH] [d3d9] Brain-dead gamma ramp validation

---
 src/d3d9/d3d9_swapchain.cpp | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/src/d3d9/d3d9_swapchain.cpp b/src/d3d9/d3d9_swapchain.cpp
index a11007b87..fb501fe08 100644
--- a/src/d3d9/d3d9_swapchain.cpp
+++ b/src/d3d9/d3d9_swapchain.cpp
@@ -668,6 +668,26 @@ namespace dxvk {
     return D3D_OK;
   }
 
+  static bool validateGammaRamp(const WORD (&ramp)[256]) {
+    if (ramp[0] >= ramp[std::size(ramp) - 1]) {
+      Logger::err("validateGammaRamp: ramp inverted or flat");
+      return false;
+    }
+
+    for (size_t i = 1; i < std::size(ramp); i++) {
+      if (ramp[i] < ramp[i - 1]) {
+        Logger::err("validateGammaRamp: ramp not monotonically increasing");
+        return false;
+      }
+      if (ramp[i] - ramp[i - 1] >= UINT16_MAX / 2) {
+        Logger::err("validateGammaRamp: huuuge jump");
+        return false;
+      }
+    }
+
+    return true;
+  }
+
 
   void    D3D9SwapChainEx::SetGammaRamp(
             DWORD         Flags,
@@ -677,6 +697,11 @@ namespace dxvk {
     if (unlikely(pRamp == nullptr))
       return;
 
+    if (unlikely(!validateGammaRamp(pRamp->red)
+              && !validateGammaRamp(pRamp->blue)
+              && !validateGammaRamp(pRamp->green)))
+      return;
+
     m_ramp = *pRamp;
 
     bool isIdentity = true;