diff options
| author | Markus Armbruster <armbru@redhat.com> | 2013-01-15 15:42:32 +0100 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2013-01-15 18:25:30 -0600 |
| commit | cc69bda6c97a1c193348eb381f4bffdfd1c8a948 (patch) | |
| tree | eee579c0c5657388a73451e6c09766330ce44f3f | |
| parent | dabe3143e0f36a78a65c0dce1e298e31df1be6c4 (diff) | |
sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits
Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].
Fix by converting to g_new().
Functions can't fail anymore, so make them return void. Caller
ignored the value anyway.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
| -rw-r--r-- | ui/sdl_zoom.c | 9 | ||||
| -rw-r--r-- | ui/sdl_zoom_template.h | 16 |
2 files changed, 10 insertions, 15 deletions
diff --git a/ui/sdl_zoom.c b/ui/sdl_zoom.c index 122027cb36..2625c4557e 100644 --- a/ui/sdl_zoom.c +++ b/ui/sdl_zoom.c @@ -13,13 +13,14 @@ #include "sdl_zoom.h" #include "qemu/osdep.h" +#include <glib.h> #include <stdint.h> #include <stdio.h> -static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth, - SDL_Rect *dst_rect); -static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth, - SDL_Rect *dst_rect); +static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth, + SDL_Rect *dst_rect); +static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth, + SDL_Rect *dst_rect); #define BPP 32 #include "sdl_zoom_template.h" diff --git a/ui/sdl_zoom_template.h b/ui/sdl_zoom_template.h index 64bbca849b..3bb508b51e 100644 --- a/ui/sdl_zoom_template.h +++ b/ui/sdl_zoom_template.h @@ -51,7 +51,7 @@ (((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \ } while (0); -static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth, +static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth, SDL_Rect *dst_rect) { int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump; @@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot sy = (int) (65536.0 * (float) src->h / (float) dst->h); } - if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) { - return (-1); - } - if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) { - free(sax); - return (-1); - } + sax = g_new(int, dst->w + 1); + say = g_new(int, dst->h + 1); sp = csp = (SDL_TYPE *) src->pixels; dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch + @@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot } } - free(sax); - free(say); - return (0); + g_free(sax); + g_free(say); } #undef SDL_TYPE |