Fixed crash in testpalette and potential crash in SDL_LoadBMP_RW()
authorSam Lantinga <slouken@libsdl.org>
Sun, 07 Dec 2008 22:25:16 +0000
changeset 28516c3fbeb04eca
parent 2850 43691ef70176
child 2852 7046f9567045
Fixed crash in testpalette and potential crash in SDL_LoadBMP_RW()
src/video/SDL_bmp.c
test/testpalette.c
     1.1 --- a/src/video/SDL_bmp.c	Sun Dec 07 22:04:24 2008 +0000
     1.2 +++ b/src/video/SDL_bmp.c	Sun Dec 07 22:25:16 2008 +0000
     1.3 @@ -218,6 +218,20 @@
     1.4          if (biClrUsed == 0) {
     1.5              biClrUsed = 1 << biBitCount;
     1.6          }
     1.7 +        if (biClrUsed > palette->ncolors) {
     1.8 +            palette->ncolors = biClrUsed;
     1.9 +            palette->colors =
    1.10 +                (SDL_Color *) SDL_realloc(palette->colors,
    1.11 +                                          palette->ncolors *
    1.12 +                                          sizeof(*palette->colors));
    1.13 +            if (!palette->colors) {
    1.14 +                SDL_OutOfMemory();
    1.15 +                was_error = 1;
    1.16 +                goto done;
    1.17 +            }
    1.18 +        } else if (biClrUsed < palette->ncolors) {
    1.19 +            palette->ncolors = biClrUsed;
    1.20 +        }
    1.21          if (biSize == 12) {
    1.22              for (i = 0; i < (int) biClrUsed; ++i) {
    1.23                  SDL_RWread(src, &palette->colors[i].b, 1, 1);
     2.1 --- a/test/testpalette.c	Sun Dec 07 22:04:24 2008 +0000
     2.2 +++ b/test/testpalette.c	Sun Dec 07 22:25:16 2008 +0000
     2.3 @@ -189,6 +189,8 @@
     2.4      SDL_SetColorKey(boat[0], SDL_SRCCOLORKEY | SDL_RLEACCEL,
     2.5                      SDL_MapRGB(boat[0]->format, 0xff, 0x00, 0xff));
     2.6      boatcols = boat[0]->format->palette->ncolors;
     2.7 +    if (boatcols >= 256)
     2.8 +        sdlerr("too many colors in sail.bmp");
     2.9      boat[1] = hflip(boat[0]);
    2.10      SDL_SetColorKey(boat[1], SDL_SRCCOLORKEY | SDL_RLEACCEL,
    2.11                      SDL_MapRGB(boat[1]->format, 0xff, 0x00, 0xff));