openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits 

Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].

Fix by converting to g_new().

Functions can't fail anymore, so make them return void.  Caller
ignored the value anyway.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Markus Armbruster 2013-01-15 15:42:32 +01:00 committed by Anthony Liguori
parent dabe3143e0
commit cc69bda6c9
2 changed files with 10 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ui/sdl_zoom.c
View File

@ -13,13 +13,14 @@
#include "sdl_zoom.h" #include "sdl_zoom.h"
#include "qemu/osdep.h" #include "qemu/osdep.h"
#include <glib.h>
#include <stdint.h> #include <stdint.h>
#include <stdio.h> #include <stdio.h>
static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth, static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect); SDL_Rect *dst_rect);
static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth, static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect); SDL_Rect *dst_rect);
#define BPP 32 #define BPP 32
#include "sdl_zoom_template.h" #include "sdl_zoom_template.h"

16
ui/sdl_zoom_template.h
View File

@ -51,7 +51,7 @@
(((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \ (((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \
} while (0); } while (0);
static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth, static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,
SDL_Rect *dst_rect) SDL_Rect *dst_rect)
{ {
int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump; int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump;
@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
sy = (int) (65536.0 * (float) src->h / (float) dst->h); sy = (int) (65536.0 * (float) src->h / (float) dst->h);
} }
if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) { sax = g_new(int, dst->w + 1);
return (-1); say = g_new(int, dst->h + 1);
}
if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) {
free(sax);
return (-1);
}
sp = csp = (SDL_TYPE *) src->pixels; sp = csp = (SDL_TYPE *) src->pixels;
dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch + dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch +
@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot
} }
} }
free(sax); g_free(sax);
free(say); g_free(say);
return (0);
} }
#undef SDL_TYPE #undef SDL_TYPE