diff options
| author | Markus Armbruster <armbru@redhat.com> | 2013-01-15 15:42:32 +0100 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2013-01-15 18:25:30 -0600 |
| commit | cc69bda6c97a1c193348eb381f4bffdfd1c8a948 (patch) | |
| tree | eee579c0c5657388a73451e6c09766330ce44f3f /ui/sdl_zoom_template.h | |
| parent | dabe3143e0f36a78a65c0dce1e298e31df1be6c4 (diff) | |
sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits
Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].
Fix by converting to g_new().
Functions can't fail anymore, so make them return void. Caller
ignored the value anyway.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'ui/sdl_zoom_template.h')
| -rw-r--r-- | ui/sdl_zoom_template.h | 16 |
1 files changed, 5 insertions, 11 deletions
diff --git a/ui/sdl_zoom_template.h b/ui/sdl_zoom_template.h index 64bbca849b..3bb508b51e 100644 --- a/ui/sdl_zoom_template.h +++ b/ui/sdl_zoom_template.h @@ -51,7 +51,7 @@ (((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \ } while (0); -static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth, +static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smooth, SDL_Rect *dst_rect) { int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, sstep, sstep_jump; @@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot sy = (int) (65536.0 * (float) src->h / (float) dst->h); } - if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) { - return (-1); - } - if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) { - free(sax); - return (-1); - } + sax = g_new(int, dst->w + 1); + say = g_new(int, dst->h + 1); sp = csp = (SDL_TYPE *) src->pixels; dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch + @@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int smoot } } - free(sax); - free(say); - return (0); + g_free(sax); + g_free(say); } #undef SDL_TYPE |