enlightenment/efl
enlightenment
/
efl
8
7
Fork 14
Code Issues 13 Pull Requests 6 Projects Releases Wiki Activity

Fix possible memory leak in eet_data_image_header_decode_cipher. 

Dynamic memory stored in 'deciphered_d' allocated through function
'eet_decipher' at line 1385 can be lost at line 1408. Also there are 3
similar errors on line(s) 1427, 1430, 1450.

Signed-off-by: Christopher Michael <cp.michael@samsung.com>
This commit is contained in:
Christopher Michael 2013-02-19 11:27:26 +00:00 committed by Stefan Schmidt
parent cc7b4a15e3
commit d33ddb5af9
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/lib/eet/eet_image.c
View File

@ -1341,8 +1341,8 @@ eet_data_image_encode_cipher(const void *data,
size = ciphered_sz;
}
else
if (ciphered_d)
free(ciphered_d);
if (ciphered_d)
free(ciphered_d);
}
if (size_ret)
@ -1389,8 +1389,8 @@ eet_data_image_header_decode_cipher(const void *data,
size = deciphered_sz;
}
else
if (deciphered_d)
free(deciphered_d);
if (deciphered_d)
free(deciphered_d);
}
if (_eet_image_words_bigendian == -1)
@ -1405,7 +1405,10 @@ eet_data_image_header_decode_cipher(const void *data,
}
if (size < 32)
return 0;
{
if (deciphered_d) free(deciphered_d);
return 0;
}
memcpy(header, data, 32);
if (_eet_image_words_bigendian)
@ -1424,10 +1427,16 @@ eet_data_image_header_decode_cipher(const void *data,
al = header[3];
cp = header[4];
if ((iw < 1) || (ih < 1) || (iw > 8192) || (ih > 8192))
return 0;
{
if (deciphered_d) free(deciphered_d);
return 0;
}
if ((cp == 0) && (size < ((iw * ih * 4) + 32)))
return 0;
{
if (deciphered_d) free(deciphered_d);
return 0;
}
if (w)
*w = iw;
@ -1514,6 +1523,7 @@ eet_data_image_header_decode_cipher(const void *data,
}
}
if (deciphered_d) free(deciphered_d);
return 0;
}