Commit cc69bda6 authored by Markus Armbruster's avatar Markus Armbruster Committed by Anthony Liguori
Browse files

sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits 



Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].

Fix by converting to g_new().

Functions can't fail anymore, so make them return void.  Caller
ignored the value anyway.

Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
parent dabe3143

ui/sdl_zoom.c

+5 −4
Original line number Diff line number Diff line
@@ -13,12 +13,13 @@ 


#include "sdl_zoom.h"

#include "qemu/osdep.h"

#include <glib.h>

#include <stdint.h>

#include <stdio.h>



static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,

static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,

                           SDL_Rect *dst_rect);

static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,

static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,

                           SDL_Rect *dst_rect);



#define BPP 32

ui/sdl_zoom_template.h

+5 −11
Original line number Diff line number Diff line
@@ -51,7 +51,7 @@ 
              (((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \

} while (0);



static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,

static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth,

                                   SDL_Rect *dst_rect)

{

    int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump;
@@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot 
        sy = (int) (65536.0 * (float) src->h / (float) dst->h);

    }



    if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) {

        return (-1);

    }

    if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) {

        free(sax);

        return (-1);

    }

    sax = g_new(int, dst->w + 1);

    say = g_new(int, dst->h + 1);



    sp = csp = (SDL_TYPE *) src->pixels;

    dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch +
@@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot 
        }

    }



    free(sax);

    free(say);

    return (0);

    g_free(sax);

    g_free(say);

}



#undef SDL_TYPE