cheng/libpng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[libpng16] Fix new leak when text compression is disabled.

Browse Source
This commit is contained in:
John Bowler 2012-08-10 10:46:45 -05:00 committed by Glenn Randers-Pehrson
parent 865e14fd32
commit 134c5761fa
4 changed files with 36 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
contrib/libtests/pngvalid.c
View File

@ -3308,6 +3308,11 @@ make_transform_image(png_store* PNG_CONST ps, png_byte PNG_CONST colour_type,
PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
#ifdef PNG_TEXT_SUPPORTED
# if (defined PNG_READ_zTXt_SUPPORTED) && (defined PNG_WRITE_zTXt_SUPPORTED)
# define TEXT_COMPRESSION PNG_TEXT_COMPRESSION_zTXt
# else
# define TEXT_COMPRESSION PNG_TEXT_COMPRESSION_NONE
# endif
{
static char key[] = "image name"; /* must be writeable */
size_t pos;
@ -3317,7 +3322,7 @@ make_transform_image(png_store* PNG_CONST ps, png_byte PNG_CONST colour_type,
/* Use a compressed text string to test the correct interaction of text
* compression and IDAT compression.
*/
text.compression = PNG_TEXT_COMPRESSION_zTXt;
text.compression = TEXT_COMPRESSION;
text.key = key;
/* Yuck: the text must be writable! */
pos = safecat(copy, sizeof copy, 0, ps->wname);
@ -3375,7 +3380,7 @@ make_transform_image(png_store* PNG_CONST ps, png_byte PNG_CONST colour_type,
/* Use a compressed text string to test the correct interaction of text
* compression and IDAT compression.
*/
text.compression = PNG_TEXT_COMPRESSION_zTXt;
text.compression = TEXT_COMPRESSION;
text.key = key;
text.text = comment;
text.text_length = (sizeof comment)-1;
@ -3546,7 +3551,7 @@ make_size_image(png_store* PNG_CONST ps, png_byte PNG_CONST colour_type,
/* Use a compressed text string to test the correct interaction of text
* compression and IDAT compression.
*/
text.compression = PNG_TEXT_COMPRESSION_zTXt;
text.compression = TEXT_COMPRESSION;
text.key = key;
/* Yuck: the text must be writable! */
pos = safecat(copy, sizeof copy, 0, ps->wname);
@ -3646,7 +3651,7 @@ make_size_image(png_store* PNG_CONST ps, png_byte PNG_CONST colour_type,
/* Use a compressed text string to test the correct interaction of text
* compression and IDAT compression.
*/
text.compression = PNG_TEXT_COMPRESSION_zTXt;
text.compression = TEXT_COMPRESSION;
text.key = key;
text.text = comment;
text.text_length = (sizeof comment)-1;
@ -4624,11 +4629,11 @@ standard_check_text(png_const_structp pp, png_const_textp tp,
pos = safecat(msg, sizeof msg, pos, ": ");
ok = pos;
if (tp->compression != PNG_TEXT_COMPRESSION_zTXt)
if (tp->compression != TEXT_COMPRESSION)
{
char buf[64];
sprintf(buf, "compression [%d->%d], ", PNG_TEXT_COMPRESSION_zTXt,
sprintf(buf, "compression [%d->%d], ", TEXT_COMPRESSION,
tp->compression);
pos = safecat(msg, sizeof msg, pos, buf);
}

2
pngset.c
View File

@ -1297,7 +1297,7 @@ png_set_compression_buffer_size(png_structrp png_ptr, png_size_t size)
}
# endif
#ifdef PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
# ifdef PNG_WRITE_SUPPORTED
if (!(png_ptr->mode & PNG_IS_READ_STRUCT))
{
if (png_ptr->zowner != 0)

2
pngwrite.c
View File

@ -872,9 +872,7 @@ png_write_destroy(png_structrp png_ptr)
deflateEnd(&png_ptr->zstream);
/* Free our memory. png_free checks NULL for us. */
#ifdef PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list);
#endif
png_free(png_ptr, png_ptr->row_buf);
#ifdef PNG_WRITE_FILTER_SUPPORTED
png_free(png_ptr, png_ptr->prev_row);

47
pngwutil.c
View File

@ -452,6 +452,27 @@ png_deflate_claim(png_structrp png_ptr, png_uint_32 owner,
}
}
/* Clean up (or trim) a linked list of compression buffers. */
void /* PRIVATE */
png_free_buffer_list(png_structrp png_ptr, png_compression_bufferp *listp)
{
png_compression_bufferp list = *listp;
if (list != NULL)
{
*listp = NULL;
do
{
png_compression_bufferp next = list->next;
png_free(png_ptr, list);
list = next;
}
while (list != NULL);
}
}
#ifdef PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
/* This pair of functions encapsulates the operation of (a) compressing a
* text string, and (b) issuing it later as a series of chunk data writes.
@ -480,26 +501,6 @@ png_text_compress_init(compression_state *comp, png_const_bytep input,
comp->output_len = 0;
}
void /* PRIVATE */
png_free_buffer_list(png_structrp png_ptr, png_compression_bufferp *listp)
{
png_compression_bufferp list = *listp;
if (list != NULL)
{
*listp = NULL;
do
{
png_compression_bufferp next = list->next;
png_free(png_ptr, list);
list = next;
}
while (list != NULL);
}
}
/* Compress the data in the compression state input */
static int
png_text_compress(png_structrp png_ptr, png_uint_32 chunk_name,
@ -1025,6 +1026,8 @@ png_compress_IDAT(png_structrp png_ptr, png_const_bytep input,
{
/* First time. Ensure we have a temporary buffer for compression and
* trim the buffer list if it has more than one entry to free memory.
* If 'WRITE_COMPRESSED_TEXT' is not set the list will never have been
* created at this point, but the check here is quick and safe.
*/
if (png_ptr->zbuffer_list == NULL)
{
@ -1033,10 +1036,8 @@ png_compress_IDAT(png_structrp png_ptr, png_const_bytep input,
png_ptr->zbuffer_list->next = NULL;
}
#ifdef PNG_WRITE_COMPRESSED_TEXT_SUPPORTED
else
png_free_buffer_list(png_ptr, &png_ptr->zbuffer_list->next);
#endif
/* It is a terminal error if we can't claim the zstream. */
if (png_deflate_claim(png_ptr, png_IDAT, png_image_size(png_ptr)) != Z_OK)
@ -1640,7 +1641,7 @@ png_write_zTXt(png_structrp png_ptr, png_const_charp key, png_const_charp text,
compression_state comp;
png_debug(1, "in png_write_zTXt");
PNG_UNUSED(text_len); /* Always use strlen */
PNG_UNUSED(text_len) /* Always use strlen */
if (compression == PNG_TEXT_COMPRESSION_NONE)
{