2011.02.22 09:54 "[Tiff] memory leak in tif_getimage.c", by Peter Hoepfner
Hi,
I've discovered a memory leak in tif_getimage.c if TIFFRGBAImageBegin()
returns an error. All resources already acquired are not released. I've
created a patch to fix this leak.
Sincerely Peter Hoepfner
---------------------------------------------------------------------------------------------------------------------
*** libtiff/tif_getimage.c.3.9.4 2011-02-22 10:40:49.000000000 +0100
--- libtiff/tif_getimage.c 2011-02-22 10:43:34.000000000 +0100
***************
*** 206,211 ****
--- 206,212 ----
_TIFFfree( img->redcmap );
_TIFFfree( img->greencmap );
_TIFFfree( img->bluecmap );
+ img->redcmap = img->greencmap = img->bluecmap = NULL;
}
}
***************
*** 474,489 ****
TIFFRGBAImage img;
int ok;
if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif,
stop, emsg)) {
img.req_orientation = orientation;
/* XXX verify rwidth and rheight against width and height */
ok = TIFFRGBAImageGet(&img, raster+(rheight-img.height)*rwidth,
rwidth, img.height);
- TIFFRGBAImageEnd(&img);
} else {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
ok = 0;
}
return (ok);
}
--- 475,491 ----
TIFFRGBAImage img;
int ok;
+ _TIFFmemset(&img, 0, sizeof(TIFFRGBAImage));
if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif,
stop, emsg)) {
img.req_orientation = orientation;
/* XXX verify rwidth and rheight against width and height */
ok = TIFFRGBAImageGet(&img, raster+(rheight-img.height)*rwidth,
rwidth, img.height);
} else {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
ok = 0;
}
+ TIFFRGBAImageEnd(&img);
return (ok);
}
***************
*** 2541,2546 ****
--- 2543,2549 ----
return (0);
}
+ _TIFFmemset(&img, 0, sizeof(TIFFRGBAImage));
if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif,
0, emsg)) {
img.row_offset = row;
***************
*** 2553,2563 ****
ok = TIFFRGBAImageGet(&img, raster, img.width, rows_to_read );
- TIFFRGBAImageEnd(&img);
} else {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
ok = 0;
}
return (ok);
}
--- 2556,2566 ----
ok = TIFFRGBAImageGet(&img, raster, img.width, rows_to_read );
} else {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
ok = 0;
}
+ TIFFRGBAImageEnd(&img);
return (ok);
}
***************
*** 2605,2612 ****
--- 2608,2617 ----
* Setup the RGBA reader.
*/
+ _TIFFmemset(&img, 0, sizeof(TIFFRGBAImage));
if (!TIFFRGBAImageOK(tif, emsg)
|| !TIFFRGBAImageBegin(&img, tif, 0, emsg)) {
+ TIFFRGBAImageEnd(&img);
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
return( 0 );
}