diff options
| author | Matthias Clasen <matthiasc@src.gnome.org> | 2002-03-21 00:31:23 +0000 |
|---|---|---|
| committer | Matthias Clasen <matthiasc@src.gnome.org> | 2002-03-21 00:31:23 +0000 |
| commit | 3b7193dd8bc775557f1e6f89c85b7f7df6592395 (patch) | |
| tree | 41febb0e34d018445e8f464a9f867aee8d4dc9ef /gdk-pixbuf/io-tga.c | |
| parent | 22b1b079ef3c55c7a3e6f2bdb873130596b3456d (diff) | |
| download | gtk+-3b7193dd8bc775557f1e6f89c85b7f7df6592395.tar.gz | |
Avoid a double free error if reading the colormap fails.
* io-tga.c (try_colormap, gdk_pixbuf__tga_stop_load): Avoid a
double free error if reading the colormap fails.
* io-tiff.c (tiff_image_parse): Make TIFFReadRGBAImage stop on
errors, since it may otherwise segfault on certain bad TIFFs.
Diffstat (limited to 'gdk-pixbuf/io-tga.c')
| -rw-r--r-- | gdk-pixbuf/io-tga.c | 23 |
1 files changed, 12 insertions, 11 deletions
diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c index 716f56ab58..69c55faa8f 100644 --- a/gdk-pixbuf/io-tga.c +++ b/gdk-pixbuf/io-tga.c @@ -622,7 +622,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err) if (!ctx->cmap->cols) { g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY, _("Can't allocate colormap entries")); - g_free(ctx->cmap); return FALSE; } @@ -645,8 +644,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err) g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, _("Unexpected bitdepth for colormap entries")); - g_free(ctx->cmap->cols); - g_free(ctx->cmap); return FALSE; } } @@ -874,19 +871,23 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err) TGAContext *ctx = (TGAContext *) data; g_return_val_if_fail(ctx != NULL, FALSE); - g_free(ctx->hdr); - if (ctx->cmap) - g_free(ctx->cmap); + if (ctx->hdr) + g_free (ctx->hdr); + if (ctx->cmap) { + if (ctx->cmap->cols) + g_free (ctx->cmap->cols); + g_free (ctx->cmap); + } if (ctx->pbuf) - g_object_unref(ctx->pbuf); + g_object_unref (ctx->pbuf); if (ctx->in->size) - ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err); + ctx->in = io_buffer_free_segment (ctx->in, ctx->in->size, err); if (!ctx->in) { - g_free(ctx); + g_free (ctx); return FALSE; } - io_buffer_free(ctx->in); - g_free(ctx); + io_buffer_free (ctx->in); + g_free (ctx); return TRUE; } |