[Qemu-devel] [PATCH] sdl: Fix heap smash in sdl_zoom_rgb{16, 32} for int > 32 bits

[Markus Armbruster]

Careless use of malloc(): allocate Uint32[N], assign to int *, use
int[N].

Fix by converting to g_new().

Functions can't fail anymore, so make them return void.  Caller
ignored the value anyway.

Signed-off-by: Markus Armbruster <address@hidden>
---
 ui/sdl_zoom.c          |  9 +++++----
 ui/sdl_zoom_template.h | 16 +++++-----------
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/ui/sdl_zoom.c b/ui/sdl_zoom.c
index 122027c..2625c45 100644
--- a/ui/sdl_zoom.c
+++ b/ui/sdl_zoom.c
@@ -13,13 +13,14 @@
 
 #include "sdl_zoom.h"
 #include "qemu/osdep.h"
+#include <glib.h>
 #include <stdint.h>
 #include <stdio.h>
 
-static int sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
-                          SDL_Rect *dst_rect);
-static int sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
-                          SDL_Rect *dst_rect);
+static void sdl_zoom_rgb16(SDL_Surface *src, SDL_Surface *dst, int smooth,
+                           SDL_Rect *dst_rect);
+static void sdl_zoom_rgb32(SDL_Surface *src, SDL_Surface *dst, int smooth,
+                           SDL_Rect *dst_rect);
 
 #define BPP 32
 #include  "sdl_zoom_template.h"
diff --git a/ui/sdl_zoom_template.h b/ui/sdl_zoom_template.h
index 64bbca8..3bb508b 100644
--- a/ui/sdl_zoom_template.h
+++ b/ui/sdl_zoom_template.h
@@ -51,7 +51,7 @@
               (((a) & (dpf->Amask >> dpf->Ashift)) << dpf->Ashift); \
 } while (0);
 
-static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int 
smooth,
+static void glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, SDL_Surface *dst, int 
smooth,
                                    SDL_Rect *dst_rect)
 {
     int x, y, sx, sy, *sax, *say, *csax, *csay, csx, csy, ex, ey, t1, t2, 
sstep, sstep_jump;
@@ -71,13 +71,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, 
SDL_Surface *dst, int smoot
         sy = (int) (65536.0 * (float) src->h / (float) dst->h);
     }
 
-    if ((sax = (int *) malloc((dst->w + 1) * sizeof(Uint32))) == NULL) {
-        return (-1);
-    }
-    if ((say = (int *) malloc((dst->h + 1) * sizeof(Uint32))) == NULL) {
-        free(sax);
-        return (-1);
-    }
+    sax = g_new(int, dst->w + 1);
+    say = g_new(int, dst->h + 1);
 
     sp = csp = (SDL_TYPE *) src->pixels;
     dp = (SDL_TYPE *) (dst->pixels + dst_rect->y * dst->pitch +
@@ -216,9 +211,8 @@ static int glue(sdl_zoom_rgb, BPP)(SDL_Surface *src, 
SDL_Surface *dst, int smoot
         }
     }
 
-    free(sax);
-    free(say);
-    return (0);
+    g_free(sax);
+    g_free(say);
 }
 
 #undef SDL_TYPE
-- 
1.7.11.7