dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-04-05 00:16:50 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

libwebp/mux: fix double free

Browse Source 
transfer ownership of chunk passed in ChunkSetNth(). prevents freeing
the chunk in e.g., MuxImageParse() when a partial assignment (alpha but
no image) has occurred.

Change-Id: Ia69656b04fdf50f098f3816b54abd4e191248de3
This commit is contained in:
James Zern 2013-03-26 20:18:13 +00:00
parent 33f9a692d9
commit 4299f39852
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mux/muxi.h
View File

@ -121,7 +121,8 @@ WebPMuxError ChunkAssignData(WebPChunk* chunk, const WebPData* const data,
// Sets 'chunk' at nth position in the 'chunk_list'. // Sets 'chunk' at nth position in the 'chunk_list'.
// nth = 0 has the special meaning "last of the list". // nth = 0 has the special meaning "last of the list".
WebPMuxError ChunkSetNth(const WebPChunk* chunk, WebPChunk** chunk_list, // On success ownership is transferred from 'chunk' to the 'chunk_list'.
WebPMuxError ChunkSetNth(WebPChunk* chunk, WebPChunk** chunk_list,
uint32_t nth); uint32_t nth);
// Releases chunk and returns chunk->next_. // Releases chunk and returns chunk->next_.

3
src/mux/muxinternal.c
View File

@ -160,7 +160,7 @@ WebPMuxError ChunkAssignData(WebPChunk* chunk, const WebPData* const data,
return WEBP_MUX_OK; return WEBP_MUX_OK;
} }
WebPMuxError ChunkSetNth(const WebPChunk* chunk, WebPChunk** chunk_list, WebPMuxError ChunkSetNth(WebPChunk* chunk, WebPChunk** chunk_list,
uint32_t nth) { uint32_t nth) {
WebPChunk* new_chunk; WebPChunk* new_chunk;
@ -171,6 +171,7 @@ WebPMuxError ChunkSetNth(const WebPChunk* chunk, WebPChunk** chunk_list,
new_chunk = (WebPChunk*)malloc(sizeof(*new_chunk)); new_chunk = (WebPChunk*)malloc(sizeof(*new_chunk));
if (new_chunk == NULL) return WEBP_MUX_MEMORY_ERROR; if (new_chunk == NULL) return WEBP_MUX_MEMORY_ERROR;
*new_chunk = *chunk; *new_chunk = *chunk;
chunk->owner_ = 0;
new_chunk->next_ = *chunk_list; new_chunk->next_ = *chunk_list;
*chunk_list = new_chunk; *chunk_list = new_chunk;
return WEBP_MUX_OK; return WEBP_MUX_OK;