rvandegrift
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

evas/cserve2: fix jpeg loader crash (invalid free) 

Signed-off-by: Cedric Bail <cedric.bail@samsung.com>
This commit is contained in:
Jean-Philippe Andre 2013-06-04 19:58:22 +09:00 committed by Cedric Bail
parent 5d7689d627
commit 54e5d651e4
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/bin/evas/loaders/jpeg/evas_image_load_jpeg.c
View File

@ -479,7 +479,7 @@ evas_image_load_file_data_jpeg_internal(Evas_Img_Load_Params *ilp,
struct jpeg_decompress_struct cinfo;
struct _JPEG_error_mgr jerr;
DATA8 *ptr, *line[16], *data;
DATA32 *ptr2, *ptr_rotate = NULL;
DATA32 *ptr2, *ptr_rotate = NULL, *ptr2_orig = NULL;
unsigned int x, y, l, i, scans;
int region = 0;
/* rotation setting */
@ -652,9 +652,10 @@ evas_image_load_file_data_jpeg_internal(Evas_Img_Load_Params *ilp,
{
ptr2 = malloc(ilp->w * ilp->h * sizeof(DATA32));
ptr_rotate = ptr2;
ptr2_orig = ptr2;
}
else
ptr2 = ilp->buffer;;
ptr2 = ilp->buffer;
if (!ptr2)
{
@ -1018,7 +1019,7 @@ done:
{
jpeg_destroy_decompress(&cinfo);
_evas_jpeg_membuf_src_term(&cinfo);
if (ptr2) free(ptr2);
if (ptr2_orig) free(ptr2_orig);
*error = CSERVE2_NONE;
return EINA_FALSE;
}
@ -1026,7 +1027,7 @@ done:
jpeg_finish_decompress(&cinfo);
jpeg_destroy_decompress(&cinfo);
_evas_jpeg_membuf_src_term(&cinfo);
if (ptr2) free(ptr2);
if (ptr2_orig) free(ptr2_orig);
*error = CSERVE2_NONE;
return EINA_TRUE;
}