callisto-debian/gtk3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

broadway: Fix possible access-after-free

Browse Source 
We need to calculate the buf pointer after the realloc.
This commit is contained in:
Alexander Larsson
2012-12-19 21:57:58 +01:00
parent 9c3cd49abd
commit 54714cb228
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
gdk/broadway/broadway.c
View File

@ -351,12 +351,12 @@ static void
append_uint16 (BroadwayOutput *output, guint32 v)
{
gsize old_len = output->buf->len;
guint8 *buf;
if (output->binary)
{
guint8 *buf = (guint8 *)output->buf->str + old_len;
g_string_set_size (output->buf, old_len + 2);
buf = (guint8 *)output->buf->str + old_len;
buf[0] = (v >> 0) & 0xff;
buf[1] = (v >> 8) & 0xff;
}
@ -371,12 +371,12 @@ static void
append_uint32 (BroadwayOutput *output, guint32 v)
{
gsize old_len = output->buf->len;
guint8 *buf;
if (output->binary)
{
guint8 *buf = (guint8 *)output->buf->str + old_len;
g_string_set_size (output->buf, old_len + 4);
buf = (guint8 *)output->buf->str + old_len;
buf[0] = (v >> 0) & 0xff;
buf[1] = (v >> 8) & 0xff;
buf[2] = (v >> 16) & 0xff;