[Spice-devel] [PATCH spice-server 1/2] server/mjpeg_encoder: realloc encoder->row, when a wider frame is given

[Alon Levy]

On Tue, May 15, 2012 at 10:08:05AM +0300, Yonit Halperin wrote:
> Fix crashes when there are sized wider frames in the stream, and we are
> linked with libjpeg.
> 
> Related : rhbz#813826
> Resolves: rhbz#820669
> ---
>  server/mjpeg_encoder.c |   10 ++++++++--
>  1 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/server/mjpeg_encoder.c b/server/mjpeg_encoder.c
> index 6bb2f69..b812ba0 100644
> --- a/server/mjpeg_encoder.c
> +++ b/server/mjpeg_encoder.c
> @@ -26,6 +26,7 @@
>  
>  struct MJpegEncoder {
>      uint8_t *row;
> +    uint32_t row_size;
>      int first_frame;
>      int quality;
>  
> @@ -196,6 +197,8 @@ int mjpeg_encoder_start_frame(MJpegEncoder *encoder, SpiceBitmapFmt format,
>  {
>      encoder->cinfo.in_color_space   = JCS_RGB;
>      encoder->cinfo.input_components = 3;
> +    encoder->pixel_converter = NULL;
> +
>      switch (format) {
>      case SPICE_BITMAP_FMT_32BIT:
>      case SPICE_BITMAP_FMT_RGBA:
> @@ -224,13 +227,16 @@ int mjpeg_encoder_start_frame(MJpegEncoder *encoder, SpiceBitmapFmt format,
>          return FALSE;
>      }
>  
> -    if ((encoder->pixel_converter != NULL) && (encoder->row == NULL)) {
> +    if (encoder->pixel_converter != NULL) {
>          unsigned int stride = width * 3;
>          /* check for integer overflow */
>          if (stride < width) {
>              return FALSE;
>          }
> -        encoder->row = spice_malloc(stride);
> +        if (encoder->row_size < stride) {
> +            encoder->row = spice_realloc(encoder->row, stride);
> +            encoder->row_size = stride;
> +        }
So we never want to reduce the size of the row?

>      }
>  
>      spice_jpeg_mem_dest(&encoder->cinfo, dest, dest_len);
> -- 
> 1.7.7.6
> 
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel