From d33ddb5af985702c4b05a5b3a2225b1108e9aca7 Mon Sep 17 00:00:00 2001 From: Christopher Michael Date: Tue, 19 Feb 2013 11:27:26 +0000 Subject: [PATCH] Fix possible memory leak in eet_data_image_header_decode_cipher. Dynamic memory stored in 'deciphered_d' allocated through function 'eet_decipher' at line 1385 can be lost at line 1408. Also there are 3 similar errors on line(s) 1427, 1430, 1450. Signed-off-by: Christopher Michael --- src/lib/eet/eet_image.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/src/lib/eet/eet_image.c b/src/lib/eet/eet_image.c index 37ab54042f..95f2a47c04 100644 --- a/src/lib/eet/eet_image.c +++ b/src/lib/eet/eet_image.c @@ -1341,8 +1341,8 @@ eet_data_image_encode_cipher(const void *data, size = ciphered_sz; } else - if (ciphered_d) - free(ciphered_d); + if (ciphered_d) + free(ciphered_d); } if (size_ret) @@ -1389,8 +1389,8 @@ eet_data_image_header_decode_cipher(const void *data, size = deciphered_sz; } else - if (deciphered_d) - free(deciphered_d); + if (deciphered_d) + free(deciphered_d); } if (_eet_image_words_bigendian == -1) @@ -1405,7 +1405,10 @@ eet_data_image_header_decode_cipher(const void *data, } if (size < 32) - return 0; + { + if (deciphered_d) free(deciphered_d); + return 0; + } memcpy(header, data, 32); if (_eet_image_words_bigendian) @@ -1424,10 +1427,16 @@ eet_data_image_header_decode_cipher(const void *data, al = header[3]; cp = header[4]; if ((iw < 1) || (ih < 1) || (iw > 8192) || (ih > 8192)) - return 0; + { + if (deciphered_d) free(deciphered_d); + return 0; + } if ((cp == 0) && (size < ((iw * ih * 4) + 32))) - return 0; + { + if (deciphered_d) free(deciphered_d); + return 0; + } if (w) *w = iw; @@ -1514,6 +1523,7 @@ eet_data_image_header_decode_cipher(const void *data, } } + if (deciphered_d) free(deciphered_d); return 0; }