Commit c24b37e5 authored by Garry R. Osgood's avatar Garry R. Osgood
Browse files

2000-11-11 Garry R. Osgood <gosgood>@idt.net *

app/gimpbrushpipe.c
Double frees due to dangling pointers [gimpbrushpipe.c
CVS-1.27 Lines 396 ff]. Upon failure to load an n-th
pixmap, a GPattern holding the dangling pointers would
be released first, also releasing n-1 pixmap's name and
RGB mask. These would again be freed in pipe and GTK
deconstruction.
parent 5ff22ad0
2000-11-11 Garry R. Osgood <gosgood>@idt.net
* app/gimpbrushpipe.c
Apropos to #8150, double frees of RGB
mask and brush name strings belonging to the the
last successfully constructed pixmap brush of a pipe
occured due to dangling pointers to these regions left
in the temporary GPattern [gimpbrushpipe.c CVS-1.27 Lines
396 ff]. Upon failure to load an n-th pixmap, the
GPattern would be released first, also releasing n-1
pixmap's name and RGB mask. These would again be freed
in pipe deconstruction. Heap memory would
remain corrupt for any type "2" variant of the bug, as
defined by Raphael Quinet in his original #8150 report.
Examples: (1) the rank cited in the pipe header is
inconsistent with actual pixmap content of pipe, or (2)
a component pixmap is missing or corrupt.
2000-11-11 Tor Lillqvist <tml@iki.fi>
* plug-ins/gimpressionist/gimpressionist.c (readdirintolist_real,
......
......@@ -434,8 +434,10 @@ gimp_brush_pipe_load (gchar *filename)
}
pipe->brushes[pipe->nbrushes]->pixmap_mask = pattern->mask;
pattern->mask = NULL; /* #8150: mask now belongs to pixmap */
g_free (pattern->name);
pattern->name = NULL; /* #8150: name no longer exists */
pipe->nbrushes++;
}
......
......@@ -434,8 +434,10 @@ gimp_brush_pipe_load (gchar *filename)
}
pipe->brushes[pipe->nbrushes]->pixmap_mask = pattern->mask;
pattern->mask = NULL; /* #8150: mask now belongs to pixmap */
g_free (pattern->name);
pattern->name = NULL; /* #8150: name no longer exists */
pipe->nbrushes++;
}
......
......@@ -434,8 +434,10 @@ gimp_brush_pipe_load (gchar *filename)
}
pipe->brushes[pipe->nbrushes]->pixmap_mask = pattern->mask;
pattern->mask = NULL; /* #8150: mask now belongs to pixmap */
g_free (pattern->name);
pattern->name = NULL; /* #8150: name no longer exists */
pipe->nbrushes++;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment