q66
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

evas/cserve2: fix jpeg loader crash (invalid free) 

Signed-off-by: Cedric Bail <cedric.bail@samsung.com>
This commit is contained in:
Jean-Philippe Andre 2013-06-04 19:58:22 +09:00 committed by Cedric Bail
parent 5d7689d627
commit 54e5d651e4
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/bin/evas/loaders/jpeg/evas_image_load_jpeg.c
View File

@ -479,7 +479,7 @@ evas_image_load_file_data_jpeg_internal(Evas_Img_Load_Params *ilp,
struct jpeg_decompress_struct cinfo; struct jpeg_decompress_struct cinfo;
struct _JPEG_error_mgr jerr; struct _JPEG_error_mgr jerr;
DATA8 *ptr, *line[16], *data; DATA8 *ptr, *line[16], *data;
DATA32 *ptr2, *ptr_rotate = NULL; DATA32 *ptr2, *ptr_rotate = NULL, *ptr2_orig = NULL;
unsigned int x, y, l, i, scans; unsigned int x, y, l, i, scans;
int region = 0; int region = 0;
/* rotation setting */ /* rotation setting */
@ -652,9 +652,10 @@ evas_image_load_file_data_jpeg_internal(Evas_Img_Load_Params *ilp,
{ {
ptr2 = malloc(ilp->w * ilp->h * sizeof(DATA32)); ptr2 = malloc(ilp->w * ilp->h * sizeof(DATA32));
ptr_rotate = ptr2; ptr_rotate = ptr2;
ptr2_orig = ptr2;
} }
else else
ptr2 = ilp->buffer;; ptr2 = ilp->buffer;
if (!ptr2) if (!ptr2)
{ {
@ -1018,7 +1019,7 @@ done:
{ {
jpeg_destroy_decompress(&cinfo); jpeg_destroy_decompress(&cinfo);
_evas_jpeg_membuf_src_term(&cinfo); _evas_jpeg_membuf_src_term(&cinfo);
if (ptr2) free(ptr2); if (ptr2_orig) free(ptr2_orig);
*error = CSERVE2_NONE; *error = CSERVE2_NONE;
return EINA_FALSE; return EINA_FALSE;
} }
@ -1026,7 +1027,7 @@ done:
jpeg_finish_decompress(&cinfo); jpeg_finish_decompress(&cinfo);
jpeg_destroy_decompress(&cinfo); jpeg_destroy_decompress(&cinfo);
_evas_jpeg_membuf_src_term(&cinfo); _evas_jpeg_membuf_src_term(&cinfo);
if (ptr2) free(ptr2); if (ptr2_orig) free(ptr2_orig);
*error = CSERVE2_NONE; *error = CSERVE2_NONE;
return EINA_TRUE; return EINA_TRUE;
} }