From 6af9e1c4b3f3ac49c69e1f9d15ebd865e6321338 Mon Sep 17 00:00:00 2001 From: Roland Shum Date: Thu, 24 Sep 2026 14:14:08 -0700 Subject: [PATCH 1/2] Validate DX10 cubemap face-count conversion on 32-bit builds --- DirectXTex/DirectXTexDDS.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/DirectXTex/DirectXTexDDS.cpp b/DirectXTex/DirectXTexDDS.cpp index 8f8f15ec..0120b221 100644 --- a/DirectXTex/DirectXTexDDS.cpp +++ b/DirectXTex/DirectXTexDDS.cpp @@ -442,6 +442,12 @@ namespace case DDS_DIMENSION_TEXTURE2D: if (d3d10ext->miscFlag & DDS_RESOURCE_MISC_TEXTURECUBE) { + // DDS_HEADER_DXT10.arraySize is a count of cubemaps; TexMetadata stores their faces. + if (metadata.arraySize > (SIZE_MAX / 6)) + { + return HRESULT_E_ARITHMETIC_OVERFLOW; + } + metadata.miscFlags |= TEX_MISC_TEXTURECUBE; metadata.arraySize *= 6; } From 481cb6dbf294c4a55bc59ae04bbf50f748b9fdba Mon Sep 17 00:00:00 2001 From: Roland Shum Date: Tue, 29 Sep 2026 10:41:28 -0700 Subject: [PATCH 2/2] Bound DDS cubemap counts before face-count conversion --- DirectXTex/DirectXTexDDS.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DirectXTex/DirectXTexDDS.cpp b/DirectXTex/DirectXTexDDS.cpp index 0120b221..08f9c0e7 100644 --- a/DirectXTex/DirectXTexDDS.cpp +++ b/DirectXTex/DirectXTexDDS.cpp @@ -443,7 +443,7 @@ namespace if (d3d10ext->miscFlag & DDS_RESOURCE_MISC_TEXTURECUBE) { // DDS_HEADER_DXT10.arraySize is a count of cubemaps; TexMetadata stores their faces. - if (metadata.arraySize > (SIZE_MAX / 6)) + if (metadata.arraySize > UINT16_MAX) { return HRESULT_E_ARITHMETIC_OVERFLOW; }