Commit cc69bda6 authored by Markus Armbruster's avatar Markus Armbruster Committed by Anthony Liguori
Browse files

sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits



Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].

Fix by converting to g_new().

Functions can't fail anymore, so make them return void.  Caller
ignored the value anyway.
Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
parent dabe3143
......@@ -13,13 +13,14 @@
#include "sdl_zoom.h"
#include "qemu/osdep.h"
#include <glib.h>
#include <stdint.h>
#include <stdio.h>
static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
#define BPP 32
#include "sdl_zoom_template.h"
......
......@@ -51,7 +51,7 @@
(((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \
} while (0);
static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,
static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect)
{
int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump;
......@@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
sy = (int) (65536.0 * (float) src->h / (float) dst->h);
}
if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) {
return (-1);
}
if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) {
free(sax);
return (-1);
}
sax = g_new(int, dst->w + 1);
say = g_new(int, dst->h + 1);
sp = csp = (SDL_TYPE *) src->pixels;
dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch +
......@@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
}
}
free(sax);
free(say);
return (0);
g_free(sax);
g_free(say);
}
#undef SDL_TYPE
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment