Commit 3b7193dd authored by Matthias Clasen's avatar Matthias Clasen

Avoid a double free error if reading the colormap fails.

	* io-tga.c (try_colormap, gdk_pixbuf__tga_stop_load): Avoid a
	double free error if reading the colormap fails.

	* io-tiff.c (tiff_image_parse): Make TIFFReadRGBAImage stop on
	errors, since it may otherwise segfault on certain bad TIFFs.
parent 22b1b079
......@@ -622,7 +622,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err)
if (!ctx->cmap->cols) {
g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
_("Can't allocate colormap entries"));
g_free(ctx->cmap);
return FALSE;
}
......@@ -645,8 +644,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err)
g_set_error(err, GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("Unexpected bitdepth for colormap entries"));
g_free(ctx->cmap->cols);
g_free(ctx->cmap);
return FALSE;
}
}
......@@ -874,19 +871,23 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err)
TGAContext *ctx = (TGAContext *) data;
g_return_val_if_fail(ctx != NULL, FALSE);
g_free(ctx->hdr);
if (ctx->cmap)
g_free(ctx->cmap);
if (ctx->hdr)
g_free (ctx->hdr);
if (ctx->cmap) {
if (ctx->cmap->cols)
g_free (ctx->cmap->cols);
g_free (ctx->cmap);
}
if (ctx->pbuf)
g_object_unref(ctx->pbuf);
g_object_unref (ctx->pbuf);
if (ctx->in->size)
ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err);
ctx->in = io_buffer_free_segment (ctx->in, ctx->in->size, err);
if (!ctx->in) {
g_free(ctx);
g_free (ctx);
return FALSE;
}
io_buffer_free(ctx->in);
g_free(ctx);
io_buffer_free (ctx->in);
g_free (ctx);
return TRUE;
}
......
......@@ -195,7 +195,7 @@ tiff_image_parse (TIFF *tiff, TiffContext *context, GError **error)
return NULL;
}
if (!TIFFReadRGBAImage (tiff, w, h, rast, 0) || global_error) {
if (!TIFFReadRGBAImage (tiff, w, h, rast, 1) || global_error) {
tiff_set_error (error,
GDK_PIXBUF_ERROR_FAILED,
_("Failed to load RGB data from TIFF file"));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment