diff options
| author | Matthias Clasen <matthiasc@src.gnome.org> | 2002-03-21 00:31:23 +0000 |
|---|---|---|
| committer | Matthias Clasen <matthiasc@src.gnome.org> | 2002-03-21 00:31:23 +0000 |
| commit | c4851cffcfa93e37a652d9d4c7f64132e4bdea37 (patch) | |
| tree | c03d3c0ffa9f37d3f6faed8314ba6e40cc8d9bd5 /gdk-pixbuf/io-tga.c | |
| parent | 00b51fa8338d77ee99398ea1e95d368a8a1bb3c3 (diff) | |
| download | gdk-pixbuf-c4851cffcfa93e37a652d9d4c7f64132e4bdea37.tar.gz | |
Avoid a double free error if reading the colormap fails.
* io-tga.c (try_colormap, gdk_pixbuf__tga_stop_load): Avoid a
double free error if reading the colormap fails.
* io-tiff.c (tiff_image_parse): Make TIFFReadRGBAImage stop on
errors, since it may otherwise segfault on certain bad TIFFs.
Diffstat (limited to 'gdk-pixbuf/io-tga.c')
| -rw-r--r-- | gdk-pixbuf/io-tga.c | 23 |
1 files changed, 12 insertions, 11 deletions
diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c index 716f56ab5..69c55faa8 100644 --- a/gdk-pixbuf/io-tga.c +++ b/gdk-pixbuf/io-tga.c @@ -622,7 +622,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err) if (!ctx->cmap->cols) { g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY, _("Can't allocate colormap entries")); - g_free(ctx->cmap); return FALSE; } @@ -645,8 +644,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err) g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, _("Unexpected bitdepth for colormap entries")); - g_free(ctx->cmap->cols); - g_free(ctx->cmap); return FALSE; } } @@ -874,19 +871,23 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err) TGAContext *ctx = (TGAContext *) data; g_return_val_if_fail(ctx != NULL, FALSE); - g_free(ctx->hdr); - if (ctx->cmap) - g_free(ctx->cmap); + if (ctx->hdr) + g_free (ctx->hdr); + if (ctx->cmap) { + if (ctx->cmap->cols) + g_free (ctx->cmap->cols); + g_free (ctx->cmap); + } if (ctx->pbuf) - g_object_unref(ctx->pbuf); + g_object_unref (ctx->pbuf); if (ctx->in->size) - ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err); + ctx->in = io_buffer_free_segment (ctx->in, ctx->in->size, err); if (!ctx->in) { - g_free(ctx); + g_free (ctx); return FALSE; } - io_buffer_free(ctx->in); - g_free(ctx); + io_buffer_free (ctx->in); + g_free (ctx); return TRUE; } |