src/video/SDL_stretch.c
changeset 4542 af1d018ebbe6
parent 4472 791b3256fb22
child 5262 b530ef003506
     1.1 --- a/src/video/SDL_stretch.c	Sun Jul 18 08:12:28 2010 -0700
     1.2 +++ b/src/video/SDL_stretch.c	Sun Jul 18 10:26:46 2010 -0700
     1.3 @@ -80,7 +80,7 @@
     1.4  
     1.5      int i;
     1.6      int pos, inc;
     1.7 -    unsigned char *eip;
     1.8 +    unsigned char *eip, *fence;
     1.9      unsigned char load, store;
    1.10  
    1.11      /* See if we need to regenerate the copy buffer */
    1.12 @@ -116,14 +116,21 @@
    1.13      pos = 0x10000;
    1.14      inc = (src_w << 16) / dst_w;
    1.15      eip = copy_row;
    1.16 +    fence = copy_row + sizeof(copy_row)-2;
    1.17      for (i = 0; i < dst_w; ++i) {
    1.18          while (pos >= 0x10000L) {
    1.19 +            if (eip == fence) {
    1.20 +                return -1;
    1.21 +            }
    1.22              if (bpp == 2) {
    1.23                  *eip++ = PREFIX16;
    1.24              }
    1.25              *eip++ = load;
    1.26              pos -= 0x10000L;
    1.27          }
    1.28 +        if (eip == fence) {
    1.29 +            return -1;
    1.30 +        }
    1.31          if (bpp == 2) {
    1.32              *eip++ = PREFIX16;
    1.33          }
    1.34 @@ -132,11 +139,6 @@
    1.35      }
    1.36      *eip++ = RETURN;
    1.37  
    1.38 -    /* Verify that we didn't overflow (too late!!!) */
    1.39 -    if (eip > (copy_row + sizeof(copy_row))) {
    1.40 -        SDL_SetError("Copy buffer overflow");
    1.41 -        return (-1);
    1.42 -    }
    1.43  #ifdef HAVE_MPROTECT
    1.44      /* Make the code executable but not writeable */
    1.45      if (mprotect(copy_row, sizeof(copy_row), PROT_READ | PROT_EXEC) < 0) {