--- a/src/video/SDL_stretch.c Sun Jul 18 08:12:48 2010 -0700
+++ b/src/video/SDL_stretch.c Sun Jul 18 10:08:06 2010 -0700
@@ -78,7 +78,7 @@
int i;
int pos, inc;
- unsigned char *eip;
+ unsigned char *eip, *end;
unsigned char load, store;
/* See if we need to regenerate the copy buffer */
@@ -115,7 +115,8 @@
pos = 0x10000;
inc = (src_w << 16) / dst_w;
eip = copy_row;
- for ( i=0; i<dst_w; ++i ) {
+ end = copy_row+sizeof(copy_row);
+ for ( i=0; i<dst_w && eip < end; ++i ) {
while ( pos >= 0x10000L ) {
if ( bpp == 2 ) {
*eip++ = PREFIX16;
@@ -132,8 +133,8 @@
*eip++ = RETURN;
/* Verify that we didn't overflow (too late!!!) */
- if ( eip > (copy_row+sizeof(copy_row)) ) {
- SDL_SetError("Copy buffer overflow");
+ if ( i < dst_w ) {
+ SDL_SetError("Copy buffer too small");
return(-1);
}
#ifdef HAVE_MPROTECT