Don't leak memory if g_try_realloc fails.

	* io-tga.c (io_buffer_append):
	* io-ico.c (DecodeHeader):
	* io-bmp.c (grow_buffer): Don't leak memory if g_try_realloc fails.

	* gdk-pixbuf-io.c (pixbuf_check_ico): Fix loading of .CUR files.
	(#91826)

5 files changed, 30 insertions, 23 deletions

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index 5e36b139d2..68a2005e73 100644
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,12 @@
+2002-09-04  Matthias Clasen  <maclas@gmx.de>
+
+	* io-tga.c (io_buffer_append): 
+	* io-ico.c (DecodeHeader): 
+	* io-bmp.c (grow_buffer): Don't leak memory if g_try_realloc fails.
+
+	* gdk-pixbuf-io.c (pixbuf_check_ico): Fix loading of .CUR files.
+	(#91826)
+
 2002-08-25  Tor Lillqvist  <tml@iki.fi>
 
 	* Makefile.am (libgdk_pixbuf_2_0_la_DEPENDENCIES): Add
diff --git a/gdk-pixbuf/gdk-pixbuf-io.c b/gdk-pixbuf/gdk-pixbuf-io.c
index c1861ad1c0..aa64867524 100644
--- a/gdk-pixbuf/gdk-pixbuf-io.c
+++ b/gdk-pixbuf/gdk-pixbuf-io.c
@@ -156,13 +156,13 @@ pixbuf_check_ico (guchar *buffer, int size)
 	    buffer [1] != 0x0 ||
 	    ((buffer [2] != 0x1)&&(buffer[2]!=0x2)) ||
 	    buffer [3] != 0x0 ||
+	    buffer [4] == 0x0 || 
 	    buffer [5] != 0x0 )
 		return FALSE;
 
 	return TRUE;
 }
 
-
 static gboolean
 pixbuf_check_bmp (guchar *buffer, int size)
 {
@@ -241,10 +241,7 @@ static GdkPixbufModule file_formats [] = {
 	{ "ras",  pixbuf_check_sunras, NULL,  NULL, NULL, NULL, NULL, NULL, NULL },
 	{ "bmp",  pixbuf_check_bmp, NULL,  NULL, NULL, NULL, NULL, NULL, NULL },
 	{ "xbm",  pixbuf_check_xbm, NULL,  NULL, NULL, NULL, NULL, NULL, NULL },
-	{ "tga", pixbuf_check_tga, NULL, NULL, NULL, NULL, NULL, NULL, NULL },
-	/* Moved at the bottom, because it causes false positives against many
-	   of my TGA files. */
-	{ "ico",  pixbuf_check_ico, NULL,  NULL, NULL, NULL, NULL, NULL, NULL },	
+	{ "ico",  pixbuf_check_ico, NULL,  NULL, NULL, NULL, NULL, NULL, NULL },            { "tga", pixbuf_check_tga, NULL, NULL, NULL, NULL, NULL, NULL, NULL },
 	{ "wbmp", pixbuf_check_wbmp, NULL, NULL, NULL, NULL, NULL, NULL, NULL },
 	{ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }
 };
diff --git a/gdk-pixbuf/io-bmp.c b/gdk-pixbuf/io-bmp.c
index 8c82f7552c..e39b169597 100644
--- a/gdk-pixbuf/io-bmp.c
+++ b/gdk-pixbuf/io-bmp.c
@@ -214,8 +214,8 @@ lsb_16 (guchar *src)
 static gboolean grow_buffer (struct bmp_progressive_state *State,
                              GError **error)
 {
-  State->buff = g_try_realloc (State->buff, State->BufferSize);
-  if (State->buff == NULL) {
+  guchar *tmp = g_try_realloc (State->buff, State->BufferSize);
+  if (!tmp) {
     g_set_error (error,
 		 GDK_PIXBUF_ERROR,
 		 GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
@@ -223,6 +223,7 @@ static gboolean grow_buffer (struct bmp_progressive_state *State,
     State->read_state = READ_STATE_ERROR;
     return FALSE;
   }
+  State->buff = tmp;
   return TRUE;
 }
 
diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c
index 3f593740cf..69fea54d1b 100644
--- a/gdk-pixbuf/io-ico.c
+++ b/gdk-pixbuf/io-ico.c
@@ -147,7 +147,6 @@ struct ico_progressive_state {
 				   1  = 1 bit bitonal 
 				 */
 
-
 	struct headerpair Header;	/* Decoded (BE->CPU) header */
 	
 	gint			DIBoffset;
@@ -199,20 +198,21 @@ static void DecodeHeader(guchar *Data, gint Bytes,
  	gint I;
  
  	/* Step 1: The ICO header */
- 
+
  	IconCount = (Data[5] << 8) + (Data[4]);
 	
  	State->HeaderSize = 6 + IconCount*16;
 
  	if (State->HeaderSize>State->BytesInHeaderBuf) {
- 		State->HeaderBuf=g_try_realloc(State->HeaderBuf,State->HeaderSize);
-		if (!State->HeaderBuf) {
+ 		guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize);
+		if (!tmp) {
 			g_set_error (error,
 				     GDK_PIXBUF_ERROR,
 				     GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
 				     _("Not enough memory to load icon"));
 			return;
 		}
+		State->HeaderBuf = tmp;
  		State->BytesInHeaderBuf = State->HeaderSize;
  	}
  	if (Bytes < State->HeaderSize)
@@ -261,14 +261,15 @@ static void DecodeHeader(guchar *Data, gint Bytes,
 	State->HeaderSize = State->DIBoffset + 40; /* 40 = sizeof(InfoHeader) */
 	
  	if (State->HeaderSize>State->BytesInHeaderBuf) {
- 		State->HeaderBuf=g_try_realloc(State->HeaderBuf,State->HeaderSize);
-		if (!State->HeaderBuf) {
+ 		guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize);
+		if (!tmp) {
 			g_set_error (error,
 				     GDK_PIXBUF_ERROR,
 				     GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
 				     _("Not enough memory to load icon"));
 			return;
 		}
+		State->HeaderBuf = tmp;
  		State->BytesInHeaderBuf = State->HeaderSize;
  	}
 	if (Bytes<State->HeaderSize) 
@@ -279,7 +280,6 @@ static void DecodeHeader(guchar *Data, gint Bytes,
 #ifdef DUMPBIH
 	DumpBIH(BIH);
 #endif	
-	
 	/* Add the palette to the headersize */
 		
 	State->Header.width =
@@ -301,14 +301,12 @@ static void DecodeHeader(guchar *Data, gint Bytes,
 			     _("Icon has zero height"));
 		return;
 	}
-	State->Header.depth = (BIH[15] << 8) + (BIH[14]);;
+	State->Header.depth = (BIH[15] << 8) + (BIH[14]);
 
 	State->Type = State->Header.depth;	
 	if (State->Lines>=State->Header.height)
 		State->Type = 1; /* The transparency mask is 1 bpp */
 	
-	
-	
 	/* Determine the  palette size. If the header indicates 0, it
 	   is actually the maximum for the bpp. You have to love the
 	   guys who made the spec. */
@@ -324,14 +322,15 @@ static void DecodeHeader(guchar *Data, gint Bytes,
 	State->HeaderSize+=I;
 	
  	if (State->HeaderSize>State->BytesInHeaderBuf) {
- 		State->HeaderBuf=g_try_realloc(State->HeaderBuf,State->HeaderSize);
-		if (!State->HeaderBuf) {
+	        guchar *tmp=g_try_realloc(State->HeaderBuf,State->HeaderSize);
+		if (!tmp) {
 			g_set_error (error,
 				     GDK_PIXBUF_ERROR,
 				     GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
 				     _("Not enough memory to load icon"));
 			return;
 		}
+		State->HeaderBuf = tmp;
  		State->BytesInHeaderBuf = State->HeaderSize;
  	}
  	if (Bytes < State->HeaderSize)
@@ -487,7 +486,7 @@ gboolean gdk_pixbuf__ico_image_stop_load(gpointer data,
          */
 
 	g_return_val_if_fail(context != NULL, TRUE);
-	
+
 	context_free (context);
         return TRUE;
 }
@@ -691,7 +690,7 @@ static void OneLineTransp(struct ico_progressive_state *context)
 		Bit = Bit & 1;
 		/* The joys of having a BGR byteorder */
 		Pixels[X * 4 + 3] = 255-Bit*255;
-#if 0		
+#if 0
 		if (Bit){
 		  Pixels[X*4+0] = 255;
 		  Pixels[X*4+1] = 255;
diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c
index 08259d8323..ff453e528f 100644
--- a/gdk-pixbuf/io-tga.c
+++ b/gdk-pixbuf/io-tga.c
@@ -182,14 +182,15 @@ static IOBuffer *io_buffer_append(IOBuffer *buffer,
 		g_memmove(buffer->data, data, len);
 		buffer->size = len;
 	} else {
-		buffer->data = g_try_realloc(buffer->data, buffer->size + len);
-		if (!buffer->data) {
+		guchar *tmp = g_try_realloc (buffer->data, buffer->size + len);
+		if (!tmp) {
 			g_set_error(err, GDK_PIXBUF_ERROR,
 				    GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
 				    _("Can't realloc IOBuffer data"));
 			g_free(buffer);
 			return NULL;
 		}
+		buffer->data = tmp;
 		g_memmove(&buffer->data[buffer->size], data, len);
 		buffer->size += len;
 	}