FreeRDP/libfreerdp/cache/brush.c
David FORT 7c3f8f33ab Fixes for malloc / calloc + other fixes
This patch contains:

* checks for malloc return value + treat callers;
* modified malloc() + ZeroMemory() to calloc();
* misc fixes of micro errors seen during the code audit:
** some invalid checks in gcc.c, also there were some possible
integer overflow. This is interesting because at the end the data are parsed
and freed directly, so it's a vulnerability in some kind of dead code (at least
useless);
** fixed usage of GetComputerNameExA with just one call, when 2 were used
in misc places. According to MSDN GetComputerNameA() is supposed to return
an error when called with NULL;
** there were a bug in the command line parsing of shadow;
** in freerdp_dynamic_channel_collection_add() the size of array was multiplied
by 4 instead of 2 on resize
2015-06-22 19:21:47 +02:00

244 lines
5.4 KiB
C

/**
* FreeRDP: A Remote Desktop Protocol Implementation
* Brush Cache
*
* Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include <stdio.h>
#include <winpr/crt.h>
#include <freerdp/log.h>
#include <freerdp/update.h>
#include <freerdp/freerdp.h>
#include <winpr/stream.h>
#include <freerdp/cache/brush.h>
#define TAG FREERDP_TAG("cache.brush")
BOOL update_gdi_patblt(rdpContext* context, PATBLT_ORDER* patblt)
{
BYTE style;
BOOL ret = TRUE;
rdpBrush* brush = &patblt->brush;
rdpCache* cache = context->cache;
style = brush->style;
if (brush->style & CACHED_BRUSH)
{
brush->data = brush_cache_get(cache->brush, brush->index, &brush->bpp);
brush->style = 0x03;
}
IFCALLRET(cache->brush->PatBlt, ret, context, patblt);
brush->style = style;
return ret;
}
BOOL update_gdi_polygon_sc(rdpContext* context, POLYGON_SC_ORDER* polygon_sc)
{
rdpCache* cache = context->cache;
return IFCALLRESULT(TRUE, cache->brush->PolygonSC, context, polygon_sc);
}
BOOL update_gdi_polygon_cb(rdpContext* context, POLYGON_CB_ORDER* polygon_cb)
{
BYTE style;
rdpBrush* brush = &polygon_cb->brush;
rdpCache* cache = context->cache;
BOOL ret = TRUE;
style = brush->style;
if (brush->style & CACHED_BRUSH)
{
brush->data = brush_cache_get(cache->brush, brush->index, &brush->bpp);
brush->style = 0x03;
}
IFCALLRET(cache->brush->PolygonCB, ret, context, polygon_cb);
brush->style = style;
return ret;
}
static BOOL update_gdi_cache_brush(rdpContext* context, CACHE_BRUSH_ORDER* cacheBrush)
{
int length;
void* data = NULL;
rdpCache* cache = context->cache;
length = cacheBrush->bpp * 64 / 8;
data = malloc(length);
if (!data)
return FALSE;
CopyMemory(data, cacheBrush->data, length);
brush_cache_put(cache->brush, cacheBrush->index, data, cacheBrush->bpp);
return TRUE;
}
void* brush_cache_get(rdpBrushCache* brushCache, UINT32 index, UINT32* bpp)
{
void* entry;
if (!brushCache)
return NULL;
if (!bpp)
return NULL;
if (*bpp == 1)
{
if (index >= brushCache->maxMonoEntries)
{
WLog_ERR(TAG, "invalid brush (%d bpp) index: 0x%04X", *bpp, index);
return NULL;
}
*bpp = brushCache->monoEntries[index].bpp;
entry = brushCache->monoEntries[index].entry;
}
else
{
if (index >= brushCache->maxEntries)
{
WLog_ERR(TAG, "invalid brush (%d bpp) index: 0x%04X", *bpp, index);
return NULL;
}
*bpp = brushCache->entries[index].bpp;
entry = brushCache->entries[index].entry;
}
if (entry == NULL)
{
WLog_ERR(TAG, "invalid brush (%d bpp) at index: 0x%04X", *bpp, index);
return NULL;
}
return entry;
}
void brush_cache_put(rdpBrushCache* brushCache, UINT32 index, void* entry, UINT32 bpp)
{
if (bpp == 1)
{
if (index >= brushCache->maxMonoEntries)
{
WLog_ERR(TAG, "invalid brush (%d bpp) index: 0x%04X", bpp, index);
free(entry);
return;
}
free(brushCache->monoEntries[index].entry);
brushCache->monoEntries[index].bpp = bpp;
brushCache->monoEntries[index].entry = entry;
}
else
{
if (index >= brushCache->maxEntries)
{
WLog_ERR(TAG, "invalid brush (%d bpp) index: 0x%04X", bpp, index);
free(entry);
return;
}
free(brushCache->entries[index].entry);
brushCache->entries[index].bpp = bpp;
brushCache->entries[index].entry = entry;
}
}
void brush_cache_register_callbacks(rdpUpdate* update)
{
rdpCache* cache = update->context->cache;
cache->brush->PatBlt = update->primary->PatBlt;
cache->brush->PolygonSC = update->primary->PolygonSC;
cache->brush->PolygonCB = update->primary->PolygonCB;
update->primary->PatBlt = update_gdi_patblt;
update->primary->PolygonSC = update_gdi_polygon_sc;
update->primary->PolygonCB = update_gdi_polygon_cb;
update->secondary->CacheBrush = update_gdi_cache_brush;
}
rdpBrushCache* brush_cache_new(rdpSettings* settings)
{
rdpBrushCache* brushCache;
brushCache = (rdpBrushCache*) calloc(1, sizeof(rdpBrushCache));
if (!brushCache)
return NULL;
brushCache->settings = settings;
brushCache->maxEntries = 64;
brushCache->maxMonoEntries = 64;
brushCache->entries = (BRUSH_ENTRY*)calloc(brushCache->maxEntries, sizeof(BRUSH_ENTRY));
if (!brushCache->entries)
goto error_entries;
brushCache->monoEntries = (BRUSH_ENTRY*) calloc(brushCache->maxMonoEntries, sizeof(BRUSH_ENTRY));
if (!brushCache->monoEntries)
goto error_mono;
return brushCache;
error_mono:
free(brushCache->entries);
error_entries:
free(brushCache);
return NULL;
}
void brush_cache_free(rdpBrushCache* brushCache)
{
int i;
if (brushCache)
{
if (brushCache->entries)
{
for (i = 0; i < (int) brushCache->maxEntries; i++)
free(brushCache->entries[i].entry);
free(brushCache->entries);
}
if (brushCache->monoEntries)
{
for (i = 0; i < (int) brushCache->maxMonoEntries; i++)
free(brushCache->monoEntries[i].entry);
free(brushCache->monoEntries);
}
free(brushCache);
}
}