diff options
| author | Markus Armbruster <armbru@redhat.com> | 2013-01-15 15:42:32 +0100 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2013-01-15 18:25:30 -0600 |
| commit | cc69bda6c97a1c193348eb381f4bffdfd1c8a948 (patch) | |
| tree | eee579c0c5657388a73451e6c09766330ce44f3f /ui/sdl_zoom.c | |
| parent | dabe3143e0f36a78a65c0dce1e298e31df1be6c4 (diff) | |
| download | qemu-cc69bda6c97a1c193348eb381f4bffdfd1c8a948.tar.gz | |
sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits
Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].
Fix by converting to g_new().
Functions can't fail anymore, so make them return void. Caller
ignored the value anyway.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'ui/sdl_zoom.c')
| -rw-r--r-- | ui/sdl_zoom.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/ui/sdl_zoom.c b/ui/sdl_zoom.c index 122027cb36..2625c4557e 100644 --- a/ui/sdl_zoom.c +++ b/ui/sdl_zoom.c @@ -13,13 +13,14 @@ #include "sdl_zoom.h" #include "qemu/osdep.h" +#include <glib.h> #include <stdint.h> #include <stdio.h> -static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth, - SDL_Rect *dst_rect); -static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth, - SDL_Rect *dst_rect); +static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth, + SDL_Rect *dst_rect); +static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth, + SDL_Rect *dst_rect); #define BPP 32 #include "sdl_zoom_template.h" |