diff options
| author | Matthieu Herrb <matthieu@herrb.eu> | 2023-01-12 15:05:39 +1000 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2023-01-12 15:47:43 -0800 |
| commit | c5ab17bcc34914c0b0707d2135dbebe9a367c5f0 (patch) | |
| tree | 91996fda87aef1dd475be48ed418b742e158d7dc | |
| parent | 515294bb8023a45ff916696d0a14308ff4f3a376 (diff) | |
| download | xorg-lib-libXpm-c5ab17bcc34914c0b0707d2135dbebe9a367c5f0.tar.gz | |
Prevent a double free in the error code path
xpmParseDataAndCreate() calls XDestroyImage() in the error path.
Reproducible with sxpm "zero-width.xpm", that file is in the test/
directory.
The same approach is needed in the bytes_per_line == 0 condition though
here it just plugs a memory leak.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
| -rw-r--r-- | src/create.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/create.c b/src/create.c index 4a85c78..f92ffef 100644 --- a/src/create.c +++ b/src/create.c @@ -994,11 +994,15 @@ CreateXImage( #if !defined(FOR_MSW) && !defined(AMIGA) if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) { XDestroyImage(*image_return); + *image_return = NULL; return XpmNoMemory; } /* now that bytes_per_line must have been set properly alloc data */ - if((*image_return)->bytes_per_line == 0 || height == 0) + if((*image_return)->bytes_per_line == 0 || height == 0) { + XDestroyImage(*image_return); + *image_return = NULL; return XpmNoMemory; + } (*image_return)->data = (char *) XpmMalloc((*image_return)->bytes_per_line * height); |