Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits

Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].

Fix by converting to g_new().

Functions can't fail anymore, so make them return void.  Caller
ignored the value anyway.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
  • Loading branch information...
commit cc69bda6c97a1c193348eb381f4bffdfd1c8a948 1 parent dabe314
Markus Armbruster authored Anthony Liguori committed
Showing with 10 additions and 15 deletions.
  1. +5 −4 ui/sdl_zoom.c
  2. +5 −11 ui/sdl_zoom_template.h
View
9 ui/sdl_zoom.c
@@ -13,13 +13,14 @@
#include "sdl_zoom.h"
#include "qemu/osdep.h"
+#include <glib.h>
#include <stdint.h>
#include <stdio.h>
-static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
- SDL_Rect *dst_rect);
-static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
- SDL_Rect *dst_rect);
+static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
+ SDL_Rect *dst_rect);
+static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
+ SDL_Rect *dst_rect);
#define BPP 32
#include "sdl_zoom_template.h"
View
16 ui/sdl_zoom_template.h
@@ -51,7 +51,7 @@
(((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \
} while (0);
-static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,
+static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect)
{
int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump;
@@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
sy = (int) (65536.0 * (float) src->h / (float) dst->h);
}
- if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) {
- return (-1);
- }
- if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) {
- free(sax);
- return (-1);
- }
+ sax = g_new(int, dst->w + 1);
+ say = g_new(int, dst->h + 1);
sp = csp = (SDL_TYPE *) src->pixels;
dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch +
@@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
}
}
- free(sax);
- free(say);
- return (0);
+ g_free(sax);
+ g_free(say);
}
#undef SDL_TYPE
Please sign in to comment.
Something went wrong with that request. Please try again.