From ae443173ec2a7941200943c09fa7dbddc2e605e1 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Andre <jp.andre@samsung.com>
Date: Tue, 1 Aug 2017 19:51:03 +0900
Subject: [PATCH] edje_svg: Fix handling of realloc

This amends 8e311db414950e399099acc1c0a as the logic
was badly broken. A "shadow" variable warning
clearly showed that "tmp" was not used properly.

This fixes the "IBM" logo in svg-test (the only one
using polygon/polyline, it seems).
---
 src/bin/edje/edje_svg_loader.c | 31 ++++++++++++-------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/src/bin/edje/edje_svg_loader.c b/src/bin/edje/edje_svg_loader.c
index 65e17f1094..03088ca638 100644
--- a/src/bin/edje/edje_svg_loader.c
+++ b/src/bin/edje/edje_svg_loader.c
@@ -1106,22 +1106,16 @@ _attr_parse_polygon_points(const char *str, double **points, int *point_count)
    int tmp_count=0;
    int count = 0;
    double num;
-   double *point_array = NULL;
+   double *point_array = NULL, *tmp_array;
 
    while (_parse_number(&str, &num))
      {
         tmp[tmp_count++] = num;
         if (tmp_count == 50)
           {
-             double *tmp;
-
-             tmp = realloc(point_array, (count + tmp_count) * sizeof(double));
-             if (!tmp)
-               {
-                  ERR("allocation for point array failed. out of memory");
-                  abort();
-               }
-             point_array = tmp;
+             tmp_array = realloc(point_array, (count + tmp_count) * sizeof(double));
+             if (!tmp_array) goto error_alloc;
+             point_array = tmp_array;
              memcpy(&point_array[count], tmp, tmp_count * sizeof(double));
              count += tmp_count;
              tmp_count = 0;
@@ -1130,20 +1124,19 @@ _attr_parse_polygon_points(const char *str, double **points, int *point_count)
 
    if (tmp_count > 0)
      {
-        double *tmp;
-
-        tmp = realloc(point_array, (count + tmp_count) * sizeof(double));
-        if (!tmp)
-          {
-             ERR("allocation for point array failed. out of memory");
-             abort();
-          }
-        point_array = tmp;
+        tmp_array = realloc(point_array, (count + tmp_count) * sizeof(double));
+        if (!tmp_array) goto error_alloc;
+        point_array = tmp_array;
         memcpy(&point_array[count], tmp, tmp_count * sizeof(double));
         count += tmp_count;
      }
    *point_count = count;
    *points = point_array;
+   return;
+
+error_alloc:
+   ERR("allocation for point array failed. out of memory");
+   abort();
 }
 
 /* parse the attributes for a polygon element.