pxcloud/spice-common
5
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice-common synced 2026-01-26 02:16:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

quic: Fix melcstate "OVERRUN" caught by coverity

Browse Source 
Check for MELCSTATES - 1 to get inside the branch, otherwise
(...)->rgb_state.melcstate may be up to MELCSTATES after the
pre-incrementing, which would result in an access to a position
that is out bounds of the array size MELCSTATES.
This commit is contained in:
Fabiano Fidêncio 2014-07-14 12:09:56 +02:00 committed by Uri Lublin
parent dd4a446f5d
commit 2c5041c3f8
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
common/quic.c
View File

@ -578,7 +578,7 @@ static void encode_run(Encoder *encoder, unsigned int runlen) //todo: try use en
while (runlen >= encoder->rgb_state.melcorder) {
hits++;
runlen -= encoder->rgb_state.melcorder;
if (encoder->rgb_state.melcstate < MELCSTATES) {
if (encoder->rgb_state.melcstate < MELCSTATES - 1) {
encoder->rgb_state.melclen = J[++encoder->rgb_state.melcstate];
encoder->rgb_state.melcorder = (1L << encoder->rgb_state.melclen);
}
@ -610,7 +610,7 @@ static void encode_channel_run(Encoder *encoder, Channel *channel, unsigned int
while (runlen >= channel->state.melcorder) {
hits++;
runlen -= channel->state.melcorder;
if (channel->state.melcstate < MELCSTATES) {
if (channel->state.melcstate < MELCSTATES - 1) {
channel->state.melclen = J[++channel->state.melcstate];
channel->state.melcorder = (1L << channel->state.melclen);
}
@ -647,7 +647,7 @@ static int decode_run(Encoder *encoder)
for (hits = 1; hits <= temp; hits++) {
runlen += encoder->rgb_state.melcorder;
if (encoder->rgb_state.melcstate < MELCSTATES) {
if (encoder->rgb_state.melcstate < MELCSTATES - 1) {
encoder->rgb_state.melclen = J[++encoder->rgb_state.melcstate];
encoder->rgb_state.melcorder = (1U << encoder->rgb_state.melclen);
}
@ -688,7 +688,7 @@ static int decode_channel_run(Encoder *encoder, Channel *channel)
for (hits = 1; hits <= temp; hits++) {
runlen += channel->state.melcorder;
if (channel->state.melcstate < MELCSTATES) {
if (channel->state.melcstate < MELCSTATES - 1) {
channel->state.melclen = J[++channel->state.melcstate];
channel->state.melcorder = (1U << channel->state.melclen);
}