[Spice-devel] [PATCH 1/6] LZ4: Fix output buffer size

[Javier Celaya]

---
 common/canvas_base.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/common/canvas_base.c b/common/canvas_base.c
index a1bfc27..cfbba5e 100644
--- a/common/canvas_base.c
+++ b/common/canvas_base.c
@@ -551,7 +551,7 @@ static pixman_image_t *canvas_get_jpeg(CanvasBase *canvas, SpiceImage *image, in
 static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int invers)
 {
     pixman_image_t *surface = NULL;
-    int dec_size, enc_size;
+    int dec_size, enc_size, available;
     int stride;
     int stride_abs;
     uint8_t *dest, *data, *data_end;
@@ -580,6 +580,7 @@ static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int
     dest = (uint8_t *)pixman_image_get_data(surface);
     stride = pixman_image_get_stride(surface);
     stride_abs = abs(stride);
+    available = height * stride_abs;
     if (direction == 1) {
         dest -= (stride_abs * (height - 1));
     }
@@ -589,7 +590,7 @@ static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int
         enc_size = ntohl(*((uint32_t *)data));
         data += 4;
         dec_size = LZ4_decompress_safe_continue(stream, (const char *) data,
-                                                (char *) dest, enc_size, height * stride_abs);
+                                                (char *) dest, enc_size, available);
         if (dec_size <= 0) {
             spice_warning("Error decoding LZ4 block\n");
             pixman_image_unref(surface);
@@ -597,6 +598,7 @@ static pixman_image_t *canvas_get_lz4(CanvasBase *canvas, SpiceImage *image, int
             break;
         }
         dest += dec_size;
+        available -= dec_size;
         data += enc_size;
     } while (data < data_end);
 
-- 
1.9.3