summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthieu Herrb <matthieu@herrb.eu>2023-01-12 15:05:39 +1000
committerAlan Coopersmith <alan.coopersmith@oracle.com>2023-01-12 15:47:43 -0800
commitc5ab17bcc34914c0b0707d2135dbebe9a367c5f0 (patch)
tree91996fda87aef1dd475be48ed418b742e158d7dc
parent515294bb8023a45ff916696d0a14308ff4f3a376 (diff)
Prevent a double free in the error code path
xpmParseDataAndCreate() calls XDestroyImage() in the error path. Reproducible with sxpm "zero-width.xpm", that file is in the test/ directory. The same approach is needed in the bytes_per_line == 0 condition though here it just plugs a memory leak. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-rw-r--r--src/create.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/create.c b/src/create.c
index 4a85c78..f92ffef 100644
--- a/src/create.c
+++ b/src/create.c
@@ -994,11 +994,15 @@ CreateXImage(
#if !defined(FOR_MSW) && !defined(AMIGA)
if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) {
XDestroyImage(*image_return);
+ *image_return = NULL;
return XpmNoMemory;
}
/* now that bytes_per_line must have been set properly alloc data */
- if((*image_return)->bytes_per_line == 0 || height == 0)
+ if((*image_return)->bytes_per_line == 0 || height == 0) {
+ XDestroyImage(*image_return);
+ *image_return = NULL;
return XpmNoMemory;
+ }
(*image_return)->data =
(char *) XpmMalloc((*image_return)->bytes_per_line * height);