ivi-layout-transition: Fix potential leak of memory pointed to by transition

Several fixes to handle invalid transition objects:

1. Free transition in ivi_layout_transition_fade_layer if we fail to
   allocate memory for data

2. Check if transition is not null and if layout_transition_register was
   ok before return, if not, free transition

3. Destroy transition if layout_transition_register was not ok, we can't
   just free transition, we need to call layout_transition_destroy in
   order to free private_data from transition

Signed-off-by: Lucas Tanure <tanure@linux.com>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>

1 files changed, 7 insertions, 4 deletions

diff --git a/ivi-shell/ivi-layout-transition.c b/ivi-shell/ivi-layout-transition.c
index 150e3017..adaa543c 100644
--- a/ivi-shell/ivi-layout-transition.c
+++ b/ivi-shell/ivi-layout-transition.c
@@ -512,7 +512,7 @@ create_visibility_transition(struct ivi_layout_surface *surface,
 		destroy_func,
 		duration);
 
-	if(!layout_transition_register(transition))
+	if (!layout_transition_register(transition))
 		layout_transition_destroy(transition);
 }
 
@@ -746,9 +746,10 @@ ivi_layout_transition_move_layer(struct ivi_layout_layer *layer,
 		NULL, NULL,
 		duration);
 
-	layout_transition_register(transition);
+	if (transition && layout_transition_register(transition))
+		return;
 
-	return;
+	free(transition);
 }
 
 void
@@ -850,6 +851,7 @@ ivi_layout_transition_fade_layer(
 	data = malloc(sizeof(*data));
 	if (data == NULL) {
 		weston_log("%s: memory allocation fails\n", __func__);
+		free(transition);
 		return;
 	}
 
@@ -871,7 +873,8 @@ ivi_layout_transition_fade_layer(
 	data->end_alpha = end_alpha;
 	data->destroy_func = destroy_func;
 
-	layout_transition_register(transition);
+	if (!layout_transition_register(transition))
+		layout_transition_destroy(transition);
 
 	return;
 }