diff options
| author | Philip Withnall <philip@tecnocode.co.uk> | 2016-12-12 23:03:22 +0000 |
|---|---|---|
| committer | Bastien Nocera <hadess@hadess.net> | 2016-12-19 19:01:18 +0100 |
| commit | 5916326b0427d8df50c5e1b0a2cc592de017935f (patch) | |
| tree | 6b1c4cb6f35ef1951cda3a7b698d6f3b49ff90a2 | |
| parent | 49dcd2d58ec3695f858c1db003851bd944a14f05 (diff) | |
| download | gdk-pixbuf-5916326b0427d8df50c5e1b0a2cc592de017935f.tar.gz | |
io-jpeg: Fix a potential infinite loop when failing to write out
If libjpeg fails to write out a scan line, this loop would never have
terminated (as next_scanline would never be incremented). Fix that by
checking for the return value from jpeg_write_scanlines().
Coverity CID 1388533
https://bugzilla.gnome.org/show_bug.cgi?id=776026
| -rw-r--r-- | gdk-pixbuf/io-jpeg.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c index 81489c392..3b0a1623c 100644 --- a/gdk-pixbuf/io-jpeg.c +++ b/gdk-pixbuf/io-jpeg.c @@ -1513,7 +1513,12 @@ real_save_jpeg (GdkPixbuf *pixbuf, /* write scanline */ jbuf = (JSAMPROW *)(&buf); - jpeg_write_scanlines (&cinfo, jbuf, 1); + if (jpeg_write_scanlines (&cinfo, jbuf, 1) == 0) { + jpeg_destroy_compress (&cinfo); + retval = FALSE; + goto cleanup; + } + i++; y++; |