Gregory Smith

Another one for the "How did this ever work?" file: when DX5_HandleMessage is called with WM_ACTIVATEAPP, it goes past the end of the 2-element SDL_DIdev array and if there doesn't happen to be a 0 in the memory next to it, crashes. Patch against SVN attached.
libsdl-org · Nov 15, 2009 · a56348f · a56348f
1 parent 85e141b
commit a56348f
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/src/video/windx5/SDL_dx5events.c b/src/video/windx5/SDL_dx5events.c
@@ -559,13 +559,15 @@ LRESULT DX5_HandleMessage(_THIS, HWND hwnd, UINT msg, WPARAM wParam, LPARAM lPar
 
 			active = (wParam && (GetForegroundWindow() == hwnd));
 			if ( active ) {
-				for ( i=0; SDL_DIdev[i]; ++i ) {
-					IDirectInputDevice2_Acquire(
+				for ( i=0; i<MAX_INPUTS; ++i ) {
+					if (SDL_DIdev[i] != NULL)
+						IDirectInputDevice2_Acquire(
 								SDL_DIdev[i]);
 				}
 			} else {
-				for ( i=0; SDL_DIdev[i]; ++i ) {
-					IDirectInputDevice2_Unacquire(
+				for ( i=0; i<MAX_INPUTS; ++i ) {
+					if (SDL_DIdev[i] != NULL) 
+						IDirectInputDevice2_Unacquire(
 								SDL_DIdev[i]);
 				}
 				mouse_lost = 1;