From: Martin Fleisz <martin.fleisz@thincast.com>
Date: Tue, 6 Mar 2018 14:32:04 +0000 (+0100)
Subject: codec: Fix broken reallocs
X-Git-Tag: 2.0.0-rc2~34^2~8
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=21eeea2cee7ddcbf2b2c7fa10a90408f72823a3b;p=platform%2Fupstream%2Ffreerdp.git

codec: Fix broken reallocs
---

diff --git a/libfreerdp/codec/nsc_encode.c b/libfreerdp/codec/nsc_encode.c
index b4350f2..492f170 100644
--- a/libfreerdp/codec/nsc_encode.c
+++ b/libfreerdp/codec/nsc_encode.c
@@ -50,11 +50,11 @@ static BOOL nsc_context_initialize_encode(NSC_CONTEXT* context)
 	{
 		for (i = 0; i < 5; i++)
 		{
-			context->priv->PlaneBuffers[i] = (BYTE*) realloc(context->priv->PlaneBuffers[i],
-			                                 length);
-
-			if (!context->priv->PlaneBuffers[i])
+			BYTE* tmp = (BYTE*) realloc(context->priv->PlaneBuffers[i], length);
+			if (!tmp)
 				goto fail;
+
+			context->priv->PlaneBuffers[i] = tmp;
 		}
 
 		context->priv->PlaneBuffersLength = length;
diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
index def5384..ce41423 100644
--- a/libfreerdp/codec/progressive.c
+++ b/libfreerdp/codec/progressive.c
@@ -1684,15 +1684,19 @@ INT32 progressive_decompress(PROGRESSIVE_CONTEXT* progressive,
 
 				if (region->numRects > progressive->cRects)
 				{
-					progressive->rects = (RFX_RECT*) realloc(progressive->rects,
-					                     region->numRects * sizeof(RFX_RECT));
+					BYTE* tmpBuf = (RFX_RECT*) realloc(progressive->rects,
+					               region->numRects * sizeof(RFX_RECT));
+					if (!tmpBuf)
+						return -1016;
+
+					progressive->rects = tmpBuf;
 					progressive->cRects = region->numRects;
 				}
 
 				region->rects = progressive->rects;
 
 				if (!region->rects)
-					return -1016;
+					return -1017;
 
 				for (index = 0; index < region->numRects; index++)
 				{
@@ -1705,20 +1709,24 @@ INT32 progressive_decompress(PROGRESSIVE_CONTEXT* progressive,
 				}
 
 				if ((blockLen - boffset) < (region->numQuant * 5))
-					return -1017;
+					return -1018;
 
 				if (region->numQuant > progressive->cQuant)
 				{
-					progressive->quantVals = (RFX_COMPONENT_CODEC_QUANT*) realloc(
+					BYTE* tmpBuf = (RFX_COMPONENT_CODEC_QUANT*) realloc(
 					                             progressive->quantVals,
 					                             region->numQuant * sizeof(RFX_COMPONENT_CODEC_QUANT));
+					if (!tmpBuf)
+						return -1019;
+
+					progressive->quantVals = tmpBuf;
 					progressive->cQuant = region->numQuant;
 				}
 
 				region->quantVals = progressive->quantVals;
 
 				if (!region->quantVals)
-					return -1018;
+					return -1020;
 
 				for (index = 0; index < region->numQuant; index++)
 				{
@@ -1734,20 +1742,24 @@ INT32 progressive_decompress(PROGRESSIVE_CONTEXT* progressive,
 				}
 
 				if ((blockLen - boffset) < (region->numProgQuant * 16))
-					return -1019;
+					return -1021;
 
 				if (region->numProgQuant > progressive->cProgQuant)
 				{
-					progressive->quantProgVals = (RFX_PROGRESSIVE_CODEC_QUANT*) realloc(
+					BYTE* tmpBuf = (RFX_PROGRESSIVE_CODEC_QUANT*) realloc(
 					                                 progressive->quantProgVals,
 					                                 region->numProgQuant * sizeof(RFX_PROGRESSIVE_CODEC_QUANT));
+					if (!tmpBuf)
+						return -1022;
+
+					progressive->quantProgVals = tmpBuf;
 					progressive->cProgQuant = region->numProgQuant;
 				}
 
 				region->quantProgVals = progressive->quantProgVals;
 
 				if (!region->quantProgVals)
-					return -1020;
+					return -1023;
 
 				for (index = 0; index < region->numProgQuant; index++)
 				{
@@ -1763,7 +1775,7 @@ INT32 progressive_decompress(PROGRESSIVE_CONTEXT* progressive,
 				}
 
 				if ((blockLen - boffset) < region->tileDataSize)
-					return -1021;
+					return -1024;
 
 				if (progressive->cTiles < surface->gridSize)
 				{