[Spice-devel] [PATCH 1/6] LZ4: Fix output buffer size

[Christophe Fergeau]

Yup, ACK, same patch as in v1 if I'm not mistaken.

On Thu, Jan 22, 2015 at 05:21:19PM +0100, Javier Celaya wrote:
> ---
>  common/canvas_base.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/common/canvas_base.c b/common/canvas_base.c
> index a1bfc27..cfbba5e 100644
> --- a/common/canvas_base.c
> +++ b/common/canvas_base.c
> @@ -551,7 +551,7 @@ static pixman_image_t *canvas_get_jpeg(CanvasBase *canvas, SpiceImage *image, in
>  static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int invers)
>  {
>      pixman_image_t *surface = NULL;
> -    int dec_size, enc_size;
> +    int dec_size, enc_size, available;
>      int stride;
>      int stride_abs;
>      uint8_t *dest, *data, *data_end;
> @@ -580,6 +580,7 @@ static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int
>      dest = (uint8_t *)pixman_image_get_data(surface);
>      stride = pixman_image_get_stride(surface);
>      stride_abs = abs(stride);
> +    available = height * stride_abs;
>      if (direction == 1) {
>          dest -= (stride_abs * (height - 1));
>      }
> @@ -589,7 +590,7 @@ static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int
>          enc_size = ntohl(*((uint32_t *)data));
>          data += 4;
>          dec_size = LZ4_decompress_safe_continue(stream, (const char *) data,
> -                                                (char *) dest, enc_size, height * stride_abs);
> +                                                (char *) dest, enc_size, available);
>          if (dec_size <= 0) {
>              spice_warning("Error decoding LZ4 block\n");
>              pixman_image_unref(surface);
> @@ -597,6 +598,7 @@ static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int
>              break;
>          }
>          dest += dec_size;
> +        available -= dec_size;
>          data += enc_size;
>      } while (data < data_end);
>  
> -- 
> 1.9.3
> 
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/spice-devel/attachments/20150123/dacf45fa/attachment.sig>