src/video/SDL_stretch.c
branchSDL-1.2
changeset 4541 abb56f7699ea
parent 4356 ab2dfac9d5c1
child 4543 d7cdc25af9a2
--- a/src/video/SDL_stretch.c	Sun Jul 18 08:12:48 2010 -0700
+++ b/src/video/SDL_stretch.c	Sun Jul 18 10:08:06 2010 -0700
@@ -78,7 +78,7 @@
 
 	int i;
 	int pos, inc;
-	unsigned char *eip;
+	unsigned char *eip, *end;
 	unsigned char load, store;
 
 	/* See if we need to regenerate the copy buffer */
@@ -115,7 +115,8 @@
 	pos = 0x10000;
 	inc = (src_w << 16) / dst_w;
 	eip = copy_row;
-	for ( i=0; i<dst_w; ++i ) {
+	end = copy_row+sizeof(copy_row);
+	for ( i=0; i<dst_w && eip < end; ++i ) {
 		while ( pos >= 0x10000L ) {
 			if ( bpp == 2 ) {
 				*eip++ = PREFIX16;
@@ -132,8 +133,8 @@
 	*eip++ = RETURN;
 
 	/* Verify that we didn't overflow (too late!!!) */
-	if ( eip > (copy_row+sizeof(copy_row)) ) {
-		SDL_SetError("Copy buffer overflow");
+	if ( i < dst_w ) {
+		SDL_SetError("Copy buffer too small");
 		return(-1);
 	}
 #ifdef HAVE_MPROTECT