diff options
| author | jkeil <jkeil@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2002-09-10 12:38:19 +0000 |
|---|---|---|
| committer | jkeil <jkeil@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2002-09-10 12:38:19 +0000 |
| commit | 9088ca28e9d6a9051c81e10d41ae83e2506ef167 (patch) | |
| tree | f1edc51f602fd89e0395244d4d4545a943f878e5 /Gui | |
| parent | 053661ed1204b65ba8a02db716481d2a8f219851 (diff) | |
| download | mpv-9088ca28e9d6a9051c81e10d41ae83e2506ef167.tar.bz2 mpv-9088ca28e9d6a9051c81e10d41ae83e2506ef167.tar.xz | |
Off-by-one error allocating bitmap, when (width*height) % 8 != 0
The code was writing beyond allocated memory, and could corrupt malloc heap.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@7353 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'Gui')
| -rw-r--r-- | Gui/bitmap.c | 2 | ||||
| -rw-r--r-- | Gui/bitmap/bitmap.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/Gui/bitmap.c b/Gui/bitmap.c index fcb4c3d2e8..e1d5a61734 100644 --- a/Gui/bitmap.c +++ b/Gui/bitmap.c @@ -114,7 +114,7 @@ void Convert32to1( txSample * in,txSample * out,int adaptivlimit ) out->Width=in->Width; out->Height=in->Height; out->BPP=1; - out->ImageSize=out->Width * out->Height / 8; + out->ImageSize=(out->Width * out->Height + 7) / 8; mp_dbg( MSGT_GPLAYER,MSGL_DBG2,"[c1to32] imagesize: %d\n",out->ImageSize ); out->Image=(char *)calloc( 1,out->ImageSize ); if ( out->Image == NULL ) mp_msg( MSGT_GPLAYER,MSGL_STATUS,"nem van ram baze\n" ); diff --git a/Gui/bitmap/bitmap.c b/Gui/bitmap/bitmap.c index fcb4c3d2e8..e1d5a61734 100644 --- a/Gui/bitmap/bitmap.c +++ b/Gui/bitmap/bitmap.c @@ -114,7 +114,7 @@ void Convert32to1( txSample * in,txSample * out,int adaptivlimit ) out->Width=in->Width; out->Height=in->Height; out->BPP=1; - out->ImageSize=out->Width * out->Height / 8; + out->ImageSize=(out->Width * out->Height + 7) / 8; mp_dbg( MSGT_GPLAYER,MSGL_DBG2,"[c1to32] imagesize: %d\n",out->ImageSize ); out->Image=(char *)calloc( 1,out->ImageSize ); if ( out->Image == NULL ) mp_msg( MSGT_GPLAYER,MSGL_STATUS,"nem van ram baze\n" ); |