diff options
| author | Alexander Larsson <alexl@redhat.com> | 2012-12-19 21:57:58 +0100 |
|---|---|---|
| committer | Alexander Larsson <alexl@redhat.com> | 2012-12-20 00:00:16 +0100 |
| commit | 54714cb22882ba97eb08a3b5eb0f0b0718a75665 (patch) | |
| tree | 5089387b2ddc1516fa79ef5157f5a4d6e780ad7d /gdk/broadway | |
| parent | 9c3cd49abdaeee28aaa3558179f45ab4efed0e9d (diff) | |
| download | gtk+-54714cb22882ba97eb08a3b5eb0f0b0718a75665.tar.gz | |
broadway: Fix possible access-after-free
We need to calculate the buf pointer after the realloc.
Diffstat (limited to 'gdk/broadway')
| -rw-r--r-- | gdk/broadway/broadway.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/gdk/broadway/broadway.c b/gdk/broadway/broadway.c index d16111e06e..157b3c1b7e 100644 --- a/gdk/broadway/broadway.c +++ b/gdk/broadway/broadway.c @@ -351,12 +351,12 @@ static void append_uint16 (BroadwayOutput *output, guint32 v) { gsize old_len = output->buf->len; + guint8 *buf; if (output->binary) { - guint8 *buf = (guint8 *)output->buf->str + old_len; - g_string_set_size (output->buf, old_len + 2); + buf = (guint8 *)output->buf->str + old_len; buf[0] = (v >> 0) & 0xff; buf[1] = (v >> 8) & 0xff; } @@ -371,12 +371,12 @@ static void append_uint32 (BroadwayOutput *output, guint32 v) { gsize old_len = output->buf->len; + guint8 *buf; if (output->binary) { - guint8 *buf = (guint8 *)output->buf->str + old_len; - g_string_set_size (output->buf, old_len + 4); + buf = (guint8 *)output->buf->str + old_len; buf[0] = (v >> 0) & 0xff; buf[1] = (v >> 8) & 0xff; buf[2] = (v >> 16) & 0xff; |