diff options
| author | Andrey Kiselev <dron@ak4719.spb.edu> | 2004-09-25 11:07:11 +0000 |
|---|---|---|
| committer | Andrey Kiselev <dron@ak4719.spb.edu> | 2004-09-25 11:07:11 +0000 |
| commit | 93226a031e5be9f3841862cd4c2dbdb594e1edab (patch) | |
| tree | e9225662b5314803b63a5e433d388530b6a7a17c | |
| parent | ba180e90d52903a824461f6dcaccaa204afe504e (diff) | |
| download | libtiff-git-93226a031e5be9f3841862cd4c2dbdb594e1edab.tar.gz | |
Potential memory leak fixed in TIFFGrowStrips() (found by Dmitry V. Levin).
| -rw-r--r-- | libtiff/tif_write.c | 25 |
1 files changed, 15 insertions, 10 deletions
diff --git a/libtiff/tif_write.c b/libtiff/tif_write.c index 8856ce57..e08ab867 100644 --- a/libtiff/tif_write.c +++ b/libtiff/tif_write.c @@ -1,4 +1,4 @@ -/* $Id: tif_write.c,v 1.12 2004-09-14 06:42:55 dron Exp $ */ +/* $Id: tif_write.c,v 1.13 2004-09-25 11:07:11 dron Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -584,21 +584,26 @@ TIFFWriteBufferSetup(TIFF* tif, tdata_t bp, tsize_t size) static int TIFFGrowStrips(TIFF* tif, int delta, const char* module) { - TIFFDirectory *td = &tif->tif_dir; + TIFFDirectory *td = &tif->tif_dir; + uint32 *new_stripoffset, *new_stripbytecount; assert(td->td_planarconfig == PLANARCONFIG_CONTIG); - td->td_stripoffset = (uint32*)_TIFFrealloc(td->td_stripoffset, - (td->td_nstrips + delta) * sizeof (uint32)); - td->td_stripbytecount = (uint32*)_TIFFrealloc(td->td_stripbytecount, - (td->td_nstrips + delta) * sizeof (uint32)); - if (td->td_stripoffset == NULL || td->td_stripbytecount == NULL) { + new_stripoffset = (uint32*)_TIFFrealloc(td->td_stripoffset, + (td->td_nstrips + delta) * sizeof (uint32)); + new_stripbytecount = (uint32*)_TIFFrealloc(td->td_stripbytecount, + (td->td_nstrips + delta) * sizeof (uint32)); + if (new_stripoffset == NULL || new_stripbytecount == NULL) { td->td_nstrips = 0; TIFFError(module, "%s: No space to expand strip arrays", - tif->tif_name); + tif->tif_name); return (0); } - _TIFFmemset(td->td_stripoffset+td->td_nstrips, 0, delta*sizeof (uint32)); - _TIFFmemset(td->td_stripbytecount+td->td_nstrips, 0, delta*sizeof (uint32)); + td->td_stripoffset = new_stripoffset; + td->td_stripbytecount = new_stripbytecount; + _TIFFmemset(td->td_stripoffset + td->td_nstrips, + 0, delta*sizeof (uint32)); + _TIFFmemset(td->td_stripbytecount + td->td_nstrips, + 0, delta*sizeof (uint32)); td->td_nstrips += delta; return (1); } |