Off-by-one error allocating bitmap, when (width*height) % 8 != 0

The code was writing beyond allocated memory, and could corrupt malloc heap.


git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@7353 b3059339-0415-0410-9bf9-f77b7e298cf2

2 files changed, 2 insertions, 2 deletions

diff --git a/Gui/bitmap.c b/Gui/bitmap.c
index fcb4c3d2e8..e1d5a61734 100644
--- a/Gui/bitmap.c
+++ b/Gui/bitmap.c
@@ -114,7 +114,7 @@ void Convert32to1( txSample * in,txSample * out,int adaptivlimit )
  out->Width=in->Width;
  out->Height=in->Height;
  out->BPP=1;
- out->ImageSize=out->Width * out->Height / 8;
+ out->ImageSize=(out->Width * out->Height + 7) / 8;
  mp_dbg( MSGT_GPLAYER,MSGL_DBG2,"[c1to32] imagesize: %d\n",out->ImageSize );
  out->Image=(char *)calloc( 1,out->ImageSize );
  if ( out->Image == NULL ) mp_msg( MSGT_GPLAYER,MSGL_STATUS,"nem van ram baze\n" );
diff --git a/Gui/bitmap/bitmap.c b/Gui/bitmap/bitmap.c
index fcb4c3d2e8..e1d5a61734 100644
--- a/Gui/bitmap/bitmap.c
+++ b/Gui/bitmap/bitmap.c
@@ -114,7 +114,7 @@ void Convert32to1( txSample * in,txSample * out,int adaptivlimit )
  out->Width=in->Width;
  out->Height=in->Height;
  out->BPP=1;
- out->ImageSize=out->Width * out->Height / 8;
+ out->ImageSize=(out->Width * out->Height + 7) / 8;
  mp_dbg( MSGT_GPLAYER,MSGL_DBG2,"[c1to32] imagesize: %d\n",out->ImageSize );
  out->Image=(char *)calloc( 1,out->ImageSize );
  if ( out->Image == NULL ) mp_msg( MSGT_GPLAYER,MSGL_STATUS,"nem van ram baze\n" );