atari:xbios: We align pointer on a 256-byte boundary, so we need to a…

…llocate enough to avoid potential out of bounds access
libsdl-org · Sep 22, 2017 · b28d5be · b28d5be
1 parent 2e39f67
commit b28d5be
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/src/video/xbios/SDL_xbios_f30.c b/src/video/xbios/SDL_xbios_f30.c
@@ -282,13 +282,13 @@ static int allocVbuffers_SV(_THIS, int num_buffers, int bufsize)
 	Uint32 tmp;
 
 	for (i=0; i<num_buffers; i++) {
-		XBIOS_screensmem[i] = Atari_SysMalloc(bufsize, MX_STRAM);
+		XBIOS_screensmem[i] = Atari_SysMalloc(bufsize+256, MX_STRAM);
 
 		if (XBIOS_screensmem[i]==NULL) {
 			SDL_SetError("Can not allocate %d KB for buffer %d", bufsize>>10, i);
 			return (0);
 		}
-		SDL_memset(XBIOS_screensmem[i], 0, bufsize);
+		SDL_memset(XBIOS_screensmem[i], 0, bufsize+256);
 
 		/* Align on 256byte boundary and map to Supervidel memory */
 		tmp = ( (Uint32) XBIOS_screensmem[i]+256) & 0xFFFFFF00UL;

diff --git a/src/video/xbios/SDL_xbios_st.c b/src/video/xbios/SDL_xbios_st.c
@@ -157,13 +157,13 @@ static int allocVbuffers(_THIS, int num_buffers, int bufsize)
 	int i;
 
 	for (i=0; i<num_buffers; i++) {
-		XBIOS_screensmem[i] = Atari_SysMalloc(bufsize, MX_STRAM);
+		XBIOS_screensmem[i] = Atari_SysMalloc(bufsize+256, MX_STRAM);
 
 		if (XBIOS_screensmem[i]==NULL) {
 			SDL_SetError("Can not allocate %d KB for buffer %d", bufsize>>10, i);
 			return (0);
 		}
-		SDL_memset(XBIOS_screensmem[i], 0, bufsize);
+		SDL_memset(XBIOS_screensmem[i], 0, bufsize+256);
 
 		XBIOS_screens[i]=(void *) (( (long) XBIOS_screensmem[i]+256) & 0xFFFFFF00UL);
 	}