mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-12-15 07:23:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

ui/pixman-minimal.h: fix empty allocation

Browse Source 
In the minimal pixman API stub that is used when the real pixman
dependency is missing a NULL dereference happens when
virtio-gpu-rutabaga allocates a pixman image with bits = NULL and
rowstride_bytes = zero. A buffer of rowstride_bytes * height is
allocated which is NULL. However, in that scenario pixman calculates a
new stride value based on given width, height and format size.

This commit adds a helper function that performs the same logic as
pixman.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20231121093840.2121195-1-manos.pitsidianakis@linaro.org>
This commit is contained in:
Manos Pitsidianakis 2023-11-21 11:38:39 +02:00 committed by Marc-André Lureau
parent ff2a5bed5f
commit e0c58720bf
1 changed files with 46 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
include/ui/pixman-minimal.h
View File

@ -113,6 +113,45 @@ typedef struct pixman_color {
uint16_t alpha;
} pixman_color_t;
static inline uint32_t *create_bits(pixman_format_code_t format,
int width,
int height,
int *rowstride_bytes)
{
int stride = 0;
size_t buf_size = 0;
int bpp = PIXMAN_FORMAT_BPP(format);
/*
* Calculate the following while checking for overflow truncation:
* stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
*/
if (unlikely(__builtin_mul_overflow(width, bpp, &stride))) {
return NULL;
}
if (unlikely(__builtin_add_overflow(stride, 0x1f, &stride))) {
return NULL;
}
stride >>= 5;
stride *= sizeof(uint32_t);
if (unlikely(__builtin_mul_overflow((size_t) height,
(size_t) stride,
&buf_size))) {
return NULL;
}
if (rowstride_bytes) {
*rowstride_bytes = stride;
}
return g_malloc0(buf_size);
}
static inline pixman_image_t *pixman_image_create_bits(pixman_format_code_t format,
int width,
int height,
@ -123,13 +162,18 @@ static inline pixman_image_t *pixman_image_create_bits(pixman_format_code_t form
i->width = width;
i->height = height;
i->stride = rowstride_bytes ?: width * DIV_ROUND_UP(PIXMAN_FORMAT_BPP(format), 8);
i->format = format;
if (bits) {
i->data = bits;
} else {
i->free_me = i->data = g_malloc0(rowstride_bytes * height);
i->free_me = i->data =
create_bits(format, width, height, &rowstride_bytes);
if (width && height) {
assert(i->data);
}
}
i->stride = rowstride_bytes ? rowstride_bytes :
width * DIV_ROUND_UP(PIXMAN_FORMAT_BPP(format), 8);
i->ref_count = 1;
return i;