Skip to content

Commit d9e1036

Browse files
committed
Fixed potential overflow in surface allocation (thanks Yves!)
1 parent 312da26 commit d9e1036

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

src/video/SDL_surface.c

+9-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,15 @@ SDL_CreateRGBSurfaceWithFormat(Uint32 flags, int width, int height, int depth,
8080

8181
/* Get the pixels */
8282
if (surface->w && surface->h) {
83-
surface->pixels = SDL_malloc(surface->h * surface->pitch);
83+
int size = (surface->h * surface->pitch);
84+
if (size < 0 || (size / surface->pitch) != surface->h) {
85+
/* Overflow... */
86+
SDL_FreeSurface(surface);
87+
SDL_OutOfMemory();
88+
return NULL;
89+
}
90+
91+
surface->pixels = SDL_malloc(size);
8492
if (!surface->pixels) {
8593
SDL_FreeSurface(surface);
8694
SDL_OutOfMemory();

0 commit comments

Comments
 (0)