morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 00:44:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

libfreerdp-codec/rfx: fix memory corruptions.

Browse Source
This commit is contained in:
Vic Lee
2013-09-03 20:27:08 +08:00
parent b04544121c
commit 86e783e4fb
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/freerdp/codec/rfx.h
View File

@@ -55,6 +55,7 @@ struct _RFX_TILE
int height;
BYTE* data;
int scanline;
BOOL allocated;
BYTE quantIdxY;
BYTE quantIdxCb;

12
libfreerdp/codec/rfx.c
View File

@@ -164,6 +164,7 @@ RFX_TILE* rfx_tile_new()
ZeroMemory(tile, sizeof(RFX_TILE));
tile->data = (BYTE*) malloc(4096 * 4); /* 64x64 * 4 */
tile->allocated = TRUE;
}
return tile;
@@ -173,7 +174,8 @@ void rfx_tile_free(RFX_TILE* tile)
{
if (tile)
{
free(tile->data);
if (tile->allocated)
free(tile->data);
free(tile);
}
}
@@ -1065,7 +1067,8 @@ RFX_MESSAGE* rfx_encode_message(RFX_CONTEXT* context, const RFX_RECT* rects,
if (!context->numQuant)
{
context->numQuant = 1;
context->quants = (UINT32*) rfx_default_quantization_values;
context->quants = (UINT32*) malloc(sizeof(rfx_default_quantization_values));
memcpy(context->quants, rfx_default_quantization_values, sizeof(rfx_default_quantization_values));
context->quantIdxY = 0;
context->quantIdxCb = 0;
context->quantIdxCr = 0;
@@ -1111,6 +1114,11 @@ RFX_MESSAGE* rfx_encode_message(RFX_CONTEXT* context, const RFX_RECT* rects,
ax = rect->x + tile->x;
ay = rect->y + tile->y;
if (tile->data && tile->allocated)
{
free(tile->data);
tile->allocated = FALSE;
}
tile->data = &data[(ay * scanline) + (ax * BytesPerPixel)];
tile->quantIdxY = context->quantIdxY;