From 481f389d19dcf92bd7af185d0ccd299ccc8c59d0 Mon Sep 17 00:00:00 2001 From: Alvin Wong Date: Sun, 23 Feb 2025 01:28:20 +0800 Subject: [PATCH] Fix buffer overrun when using a larger pitch --- src/Draw.c | 6 +++--- src/Tilengine.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/Draw.c b/src/Draw.c index 8890561b..f0e10a9d 100644 --- a/src/Draw.c +++ b/src/Draw.c @@ -65,7 +65,7 @@ static bool draw_background_scanline(int nlayer, int line) scan = GetFramebufferLine(line); if (scan == engine->linebuffer) - memset(scan, 0, engine->framebuffer.pitch); + memset(scan, 0, engine->framebuffer.width * sizeof(*scan)); /* regular region */ if (scan != NULL) @@ -91,7 +91,7 @@ static bool draw_background_scanline(int nlayer, int line) /* build mosaic to linebuffer */ if (build_mosaic) { - memset(mosaic, 0, engine->framebuffer.pitch); + memset(mosaic, 0, engine->framebuffer.width * sizeof(*mosaic)); BlitMosaic(engine->linebuffer, mosaic, framewidth, layer->mosaic.w, NULL); } @@ -170,7 +170,7 @@ bool DrawScanline(void) if (engine->numlayers > 0) { background_priority = false; - memset(engine->priority, 0, engine->framebuffer.pitch); + memset(engine->priority, 0, engine->framebuffer.width * sizeof(*engine->priority)); for (c = engine->numlayers - 1; c >= 0; c--) { Layer* layer = &engine->layers[c]; diff --git a/src/Tilengine.c b/src/Tilengine.c index c3763d38..17586f7e 100644 --- a/src/Tilengine.c +++ b/src/Tilengine.c @@ -103,7 +103,7 @@ static TLN_Engine create_context(int hres, int vres, int numlayers, int numsprit /* buffer for intermediate scanline output */ context->linebuffer = (uint32_t*)calloc(hres, sizeof(uint32_t)); - context->priority = (uint32_t*)malloc(context->framebuffer.pitch); + context->priority = (uint32_t*)calloc(hres, sizeof(uint32_t)); } /* create static sprites */