mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits

Browse Source 
Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].

Fix by converting to g_new().

Functions can't fail anymore, so make them return void.  Caller
ignored the value anyway.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Markus Armbruster 2013-01-15 15:42:32 +01:00 committed by Anthony Liguori
parent dabe3143e0
commit cc69bda6c9
2 changed files with 10 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ui/sdl_zoom.c
View File

@ -13,13 +13,14 @@
#include "sdl_zoom.h"
#include "qemu/osdep.h"
#include <glib.h>
#include <stdint.h>
#include <stdio.h>
static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect);
#define BPP 32
#include "sdl_zoom_template.h"

16
ui/sdl_zoom_template.h
View File

@ -51,7 +51,7 @@
(((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \
} while (0);
static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,
static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect)
{
int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump;
@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
sy = (int) (65536.0 * (float) src->h / (float) dst->h);
}
if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) {
return (-1);
}
if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) {
free(sax);
return (-1);
}
sax = g_new(int, dst->w + 1);
say = g_new(int, dst->h + 1);
sp = csp = (SDL_TYPE *) src->pixels;
dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch +
@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
}
}
free(sax);
free(say);
return (0);
g_free(sax);
g_free(say);
}
#undef SDL_TYPE