duuqnd/cave-story-solaris
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ScaleAndUploadSurface now doesn't take ownership of the surface it is passed and frees it. This is to correct multiple occurences of use-after-free occuring from use of the passed surface after a call to ScaleAndUploadSurface using it

Browse source
This commit is contained in:
Gabriel Ravier 2020-01-06 10:43:28 +01:00
parent 5d12071f17
commit befb5f7fb5
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/Draw.cpp
View file

@ -160,8 +160,6 @@ static BOOL ScaleAndUploadSurface(SDL_Surface *surface, SurfaceID surf_no)
{ {
SDL_Surface *converted_surface = SDL_ConvertSurfaceFormat(surface, SDL_PIXELFORMAT_RGB24, 0); SDL_Surface *converted_surface = SDL_ConvertSurfaceFormat(surface, SDL_PIXELFORMAT_RGB24, 0);
SDL_FreeSurface(surface);
if (converted_surface == NULL) if (converted_surface == NULL)
return FALSE; return FALSE;
@ -243,6 +241,7 @@ BOOL MakeSurface_Resource(const char *name, SurfaceID surf_no)
if (!ScaleAndUploadSurface(surface, surf_no)) if (!ScaleAndUploadSurface(surface, surf_no))
{ {
Backend_FreeSurface(surf[surf_no]); Backend_FreeSurface(surf[surf_no]);
SDL_FreeSurface(surface);
return FALSE; return FALSE;
} }
@ -251,6 +250,7 @@ BOOL MakeSurface_Resource(const char *name, SurfaceID surf_no)
surface_metadata[surf_no].height = surface->h; surface_metadata[surf_no].height = surface->h;
surface_metadata[surf_no].bSystem = FALSE; surface_metadata[surf_no].bSystem = FALSE;
strcpy(surface_metadata[surf_no].name, name); strcpy(surface_metadata[surf_no].name, name);
SDL_FreeSurface(surface);
return TRUE; return TRUE;
} }
@ -302,6 +302,7 @@ BOOL MakeSurface_File(const char *name, SurfaceID surf_no)
if (!ScaleAndUploadSurface(surface, surf_no)) if (!ScaleAndUploadSurface(surface, surf_no))
{ {
Backend_FreeSurface(surf[surf_no]); Backend_FreeSurface(surf[surf_no]);
SDL_FreeSurface(surface);
return FALSE; return FALSE;
} }
@ -310,6 +311,7 @@ BOOL MakeSurface_File(const char *name, SurfaceID surf_no)
surface_metadata[surf_no].height = surface->h; surface_metadata[surf_no].height = surface->h;
surface_metadata[surf_no].bSystem = FALSE; surface_metadata[surf_no].bSystem = FALSE;
strcpy(surface_metadata[surf_no].name, name); strcpy(surface_metadata[surf_no].name, name);
SDL_FreeSurface(surface);
return TRUE; return TRUE;
} }
@ -327,7 +329,12 @@ BOOL ReloadBitmap_Resource(const char *name, SurfaceID surf_no)
SDL_Surface *surface = SDL_LoadBMP_RW(fp, 1); SDL_Surface *surface = SDL_LoadBMP_RW(fp, 1);
if (!ScaleAndUploadSurface(surface, surf_no)) if (!ScaleAndUploadSurface(surface, surf_no))
{
SDL_FreeSurface(surface);
return FALSE; return FALSE;
}
SDL_FreeSurface(surface);
surface_metadata[surf_no].type = SURFACE_SOURCE_RESOURCE; surface_metadata[surf_no].type = SURFACE_SOURCE_RESOURCE;
strcpy(surface_metadata[surf_no].name, name); strcpy(surface_metadata[surf_no].name, name);
@ -366,8 +373,12 @@ BOOL ReloadBitmap_File(const char *name, SurfaceID surf_no)
} }
if (!ScaleAndUploadSurface(surface, surf_no)) if (!ScaleAndUploadSurface(surface, surf_no))
{
SDL_FreeSurface(surface);
return FALSE; return FALSE;
}
SDL_FreeSurface(surface);
surface_metadata[surf_no].type = SURFACE_SOURCE_FILE; surface_metadata[surf_no].type = SURFACE_SOURCE_FILE;
strcpy(surface_metadata[surf_no].name, name); strcpy(surface_metadata[surf_no].name, name);