From 763b82b1e482e3bce13f5226ead308d731703b72 Mon Sep 17 00:00:00 2001
From: Robin Kertels <robin.kertels@gmail.com>
Date: Tue, 15 Oct 2024 10:20:24 +0200
Subject: [PATCH] [d3d9] Fix render target null pointer deref

---
 src/d3d9/d3d9_device.cpp | 6 +++---
 src/d3d9/d3d9_device.h   | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/d3d9/d3d9_device.cpp b/src/d3d9/d3d9_device.cpp
index 08734a086..156976d3b 100644
--- a/src/d3d9/d3d9_device.cpp
+++ b/src/d3d9/d3d9_device.cpp
@@ -1841,9 +1841,9 @@ namespace dxvk {
       // Clear render targets if we need to.
       if (Flags & D3DCLEAR_TARGET) {
         for (uint32_t rt = 0u; rt < m_state.renderTargets.size(); rt++) {
-          const auto& rts = m_state.renderTargets[rt];
-          if (rts == nullptr)
+          if (!HasRenderTargetBound(rt))
             continue;
+          const auto& rts = m_state.renderTargets[rt];
           const auto& rtv = rts->GetRenderTargetView(srgb);
 
           if (likely(rtv != nullptr)) {
@@ -6329,7 +6329,7 @@ namespace dxvk {
     uint32_t limitsRenderAreaMask = 0u;
     VkExtent2D renderArea = { ~0u, ~0u };
     for (uint32_t i = 0u; i < m_state.renderTargets.size(); i++) {
-      if (m_state.renderTargets[i] == nullptr)
+      if (!HasRenderTargetBound(i))
         continue;
 
       const DxvkImageCreateInfo& rtImageInfo = m_state.renderTargets[i]->GetCommonTexture()->GetImage()->info();
diff --git a/src/d3d9/d3d9_device.h b/src/d3d9/d3d9_device.h
index 2714710c9..9266d05e9 100644
--- a/src/d3d9/d3d9_device.h
+++ b/src/d3d9/d3d9_device.h
@@ -1300,6 +1300,9 @@ namespace dxvk {
     bool IsTextureBoundAsAttachment(const D3D9CommonTexture* pTexture) const {
       if (unlikely(pTexture->IsRenderTarget())) {
         for (uint32_t i = 0u; i < m_state.renderTargets.size(); i++) {
+          if (m_state.renderTargets[i] == nullptr)
+            continue;
+
           auto texInfo = m_state.renderTargets[i]->GetCommonTexture();
           if (unlikely(texInfo == pTexture)) {
             return true;