[Qemu-devel] [TestDays] Illegal memory reads in SDL zoom

[Stefan Weil]

SDL zoom is based on buggy old code imported from SDL rotozoom.
This code shows errors when QEMU is run with Valgrind.

Valgrind was started like this from QEMU's source directory on a
netbook running Ubuntu (important because the default desktop
zooms QEMU's window immediately after the start):

valgrind -v --error-limit=no --track-origins=yes --smc-check=all \
    --leak-check=full bin/debug/386/i386-softmmu/qemu-system-i386 -L 
pc-bios

==29459== Invalid read of size 4
==29459==    at 0x8164F26: sdl_zoom_rgb32 (sdl_zoom_template.h:137)
==29459==    by 0x8166488: sdl_zoom_blit (sdl_zoom.c:82)
==29459==    by 0x8162B73: sdl_update (sdl.c:76)
==29459==    by 0x8246CA1: dpy_update (console.h:240)
==29459==    by 0x824C336: vga_draw_text (vga.c:1412)
==29459==    by 0x824D012: vga_update_display (vga.c:1858)
==29459==    by 0x809B31F: vga_hw_update (console.c:167)
==29459==    by 0x8164436: sdl_refresh (sdl.c:861)
==29459==    by 0x8112AC1: dpy_refresh (console.h:267)
==29459==    by 0x8114926: gui_update (vl.c:1210)
==29459==    by 0x8142D64: qemu_run_timers (qemu-timer.c:420)
==29459==    by 0x8142EE8: qemu_run_all_timers (qemu-timer.c:483)
==29459==  Address 0x7d5e3c0 is 4 bytes after a block of size 36 alloc'd
==29459==    at 0x4024F20: malloc (vg_replace_malloc.c:236)
==29459==    by 0x8116511: malloc_and_trace (vl.c:2134)
==29459==    by 0x4099243: g_malloc (in /lib/libglib-2.0.so.0.2400.1)
==29459==    by 0x809D9AA: qemu_alloc_display (console.c:1302)
==29459==    by 0x8163113: sdl_create_displaysurface (sdl.c:188)
==29459==    by 0x8163244: sdl_resize_displaysurface (sdl.c:225)
==29459==    by 0x809AF35: qemu_resize_displaysurface (console.h:208)
==29459==    by 0x809E266: qemu_console_resize (console.c:1574)
==29459==    by 0x824BDCB: vga_draw_text (vga.c:1309)
==29459==    by 0x824D012: vga_update_display (vga.c:1858)
==29459==    by 0x809B31F: vga_hw_update (console.c:167)
==29459==    by 0x8164436: sdl_refresh (sdl.c:861)
==29459==
==29459== Invalid read of size 4
==29459==    at 0x8164F43: sdl_zoom_rgb32 (sdl_zoom_template.h:137)
==29459==    by 0x8166488: sdl_zoom_blit (sdl_zoom.c:82)
==29459==    by 0x8162B73: sdl_update (sdl.c:76)
==29459==    by 0x8246CA1: dpy_update (console.h:240)
==29459==    by 0x824C336: vga_draw_text (vga.c:1412)
==29459==    by 0x824D012: vga_update_display (vga.c:1858)
==29459==    by 0x809B31F: vga_hw_update (console.c:167)
==29459==    by 0x8164436: sdl_refresh (sdl.c:861)
==29459==    by 0x8112AC1: dpy_refresh (console.h:267)
==29459==    by 0x8114926: gui_update (vl.c:1210)
==29459==    by 0x8142D64: qemu_run_timers (qemu-timer.c:420)
==29459==    by 0x8142EE8: qemu_run_all_timers (qemu-timer.c:483)
==29459==  Address 0x7d5e3bc is 0 bytes after a block of size 36 alloc'd
==29459==    at 0x4024F20: malloc (vg_replace_malloc.c:236)
==29459==    by 0x8116511: malloc_and_trace (vl.c:2134)
==29459==    by 0x4099243: g_malloc (in /lib/libglib-2.0.so.0.2400.1)
==29459==    by 0x809D9AA: qemu_alloc_display (console.c:1302)
==29459==    by 0x8163113: sdl_create_displaysurface (sdl.c:188)
==29459==    by 0x8163244: sdl_resize_displaysurface (sdl.c:225)
==29459==    by 0x809AF35: qemu_resize_displaysurface (console.h:208)
==29459==    by 0x809E266: qemu_console_resize (console.c:1574)
==29459==    by 0x824BDCB: vga_draw_text (vga.c:1309)
==29459==    by 0x824D012: vga_update_display (vga.c:1858)
==29459==    by 0x809B31F: vga_hw_update (console.c:167)
==29459==    by 0x8164436: sdl_refresh (sdl.c:861)
==29459==