From bc68c41d5ffbff856c3a3c29af047bee19710a58 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Tue, 1 Aug 2017 15:24:21 -0500
Subject: [PATCH] [libpng16] Initialized btoa[] in pngstest.c; stop memory leak
 in png_handle_eXIf()

when returning with an error.
---
 ANNOUNCE                    | 4 ++++
 CHANGES                     | 4 ++++
 contrib/libtests/pngstest.c | 2 +-
 pngrutil.c                  | 3 +++
 4 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index fb2cc72d4..8168de3ed 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -39,6 +39,10 @@ Version 1.6.32beta01 [July 31, 2017]
 Version 1.6.32beta02 [August 1, 2017]
   Updated contrib/libtests/pngunknown.c with eXIf chunk.
 
+Version 1.6.32beta03 [August 1, 2017]
+  Initialized btoa[] in pngstest.c
+  Stop memory leak when returning from png_handle_eXIf() with an error.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
diff --git a/CHANGES b/CHANGES
index 8935d2654..174db2c36 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5922,6 +5922,10 @@ Version 1.6.32beta01 [July 31, 2017]
 Version 1.6.32beta02 [August 1, 2017]
   Updated contrib/libtests/pngunknown.c with eXIf chunk.
 
+Version 1.6.32beta03 [August 1, 2017]
+  Initialized btoa[] in pngstest.c
+  Stop memory leak when returning from png_handle_eXIf() with an error.
+
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
 https://lists.sourceforge.net/lists/listinfo/png-mng-implement
diff --git a/contrib/libtests/pngstest.c b/contrib/libtests/pngstest.c
index 0617dbb04..ab4508930 100644
--- a/contrib/libtests/pngstest.c
+++ b/contrib/libtests/pngstest.c
@@ -2610,9 +2610,9 @@ compare_two_images(Image *a, Image *b, int via_linear,
    const unsigned int b_sample = PNG_IMAGE_SAMPLE_SIZE(formatb);
    int alpha_added, alpha_removed;
    int bchannels;
-   int btoa[4];
    png_uint_32 y;
    Transform tr;
+   int btoa[4]={0,0,0,0};
 
    /* This should never happen: */
    if (width != b->image.width || height != b->image.height)
diff --git a/pngrutil.c b/pngrutil.c
index f0e172897..3be7c17cc 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -2039,7 +2039,10 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
    }
 
    if (png_crc_finish(png_ptr, 0) != 0)
+   {
+      png_free(png_ptr, eXIf_buf);
       return;
+   }
 
    png_set_eXIf_1(png_ptr, info_ptr, length, eXIf_buf);