p/fiv
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Plug a corner-case memory leak, fix range checks

Browse Source
This commit is contained in:
Přemysl Eric Janouch 2022-01-21 19:01:00 +01:00
parent 4ba1d85363
commit 686d45553b
Signed by: p
GPG Key ID: A0420B94F92B9493
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fiv-io.c
View File

@ -1368,7 +1368,7 @@ open_resvg(const gchar *data, gsize len, const gchar *uri, GError **error)
// TODO(p): Support retrieving a scaled-up/down version. // TODO(p): Support retrieving a scaled-up/down version.
// TODO(p): See if there is a situation for resvg_get_image_viewbox(). // TODO(p): See if there is a situation for resvg_get_image_viewbox().
resvg_size size = resvg_get_image_size(tree); resvg_size size = resvg_get_image_size(tree);
int w = ceil(size.width), h = ceil(size.height); double w = ceil(size.width), h = ceil(size.height);
if (w > SHRT_MAX || h > SHRT_MAX) { if (w > SHRT_MAX || h > SHRT_MAX) {
set_error(error, "image dimensions overflow"); set_error(error, "image dimensions overflow");
resvg_tree_destroy(tree); resvg_tree_destroy(tree);
@ -1381,6 +1381,7 @@ open_resvg(const gchar *data, gsize len, const gchar *uri, GError **error)
if (surface_status != CAIRO_STATUS_SUCCESS) { if (surface_status != CAIRO_STATUS_SUCCESS) {
set_error(error, cairo_status_to_string(surface_status)); set_error(error, cairo_status_to_string(surface_status));
cairo_surface_destroy(surface); cairo_surface_destroy(surface);
resvg_tree_destroy(tree);
return NULL; return NULL;
} }