On 05/15/2012 02:02 PM, Alon Levy wrote:
On Tue, May 15, 2012 at 10:08:05AM +0300, Yonit Halperin wrote:
Fix crashes when there are sized wider frames in the stream, and we are
linked with libjpeg.
Related : rhbz#813826
Resolves: rhbz#820669
---
server/mjpeg_encoder.c | 10 ++++++++--
1 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/server/mjpeg_encoder.c b/server/mjpeg_encoder.c
index 6bb2f69..b812ba0 100644
--- a/server/mjpeg_encoder.c
+++ b/server/mjpeg_encoder.c
@@ -26,6 +26,7 @@
struct MJpegEncoder {
uint8_t *row;
+ uint32_t row_size;
int first_frame;
int quality;
@@ -196,6 +197,8 @@ int mjpeg_encoder_start_frame(MJpegEncoder *encoder,
SpiceBitmapFmt format,
{
encoder->cinfo.in_color_space = JCS_RGB;
encoder->cinfo.input_components = 3;
+ encoder->pixel_converter = NULL;
+
switch (format) {
case SPICE_BITMAP_FMT_32BIT:
case SPICE_BITMAP_FMT_RGBA:
@@ -224,13 +227,16 @@ int mjpeg_encoder_start_frame(MJpegEncoder *encoder,
SpiceBitmapFmt format,
return FALSE;
}
- if ((encoder->pixel_converter != NULL)&& (encoder->row == NULL)) {
+ if (encoder->pixel_converter != NULL) {
unsigned int stride = width * 3;
/* check for integer overflow */
if (stride< width) {
return FALSE;
}
- encoder->row = spice_malloc(stride);
+ if (encoder->row_size< stride) {
+ encoder->row = spice_realloc(encoder->row, stride);
+ encoder->row_size = stride;
+ }
So we never want to reduce the size of the row?
I don't think it is necessary and desired, since as the stream continue,
you will probably encounter more frames that are wider than the original
stream.
}
spice_jpeg_mem_dest(&encoder->cinfo, dest, dest_len);
--
1.7.7.6
_______________________________________________
Spice-devel mailing list
Spice-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/spice-devel
_______________________________________________
Spice-devel mailing list
Spice-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/spice-devel
