From fd6b87253c5663173c00f2fbf766c10202061deb Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
Date: Wed, 2 Aug 2017 06:35:15 -0500
Subject: [PATCH] [libpng16] Eliminate local eXIf_buf from png_handle_eXIf()

---
 pngrutil.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/pngrutil.c b/pngrutil.c
index 7e6ac2077..c56c49132 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -2015,8 +2015,6 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
 {
    unsigned int i;
 
-   png_bytep eXIf_buf;
-
    png_debug(1, "in png_handle_eXIf");
 
    if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
@@ -2029,32 +2027,31 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
       return;
    }
 
-   eXIf_buf = png_voidcast(png_bytep,
+   info_ptr->eXIf_buf = png_voidcast(png_bytep,
              png_malloc_warn(png_ptr, length));
 
-   if (eXIf_buf == NULL)
+   if (info_ptr->eXIf_buf == NULL)
    {
       png_crc_finish(png_ptr, length);
       png_chunk_benign_error(png_ptr, "out of memory");
       return;
    }
 
-   info_ptr->eXIf_buf = eXIf_buf; /* So it will be freed on error */
    info_ptr->free_me |= PNG_FREE_EXIF;
    for (i = 0; i < length; i++)
    {
       png_byte buf[1];
       png_crc_read(png_ptr, buf, 1);
-      eXIf_buf[i] = buf[0];
+      info_ptr->eXIf_buf[i] = buf[0];
    }
-   info_ptr->eXIf_buf = NULL;
 
    if (png_crc_finish(png_ptr, 0) != 0)
       return;
 
-   png_set_eXIf_1(png_ptr, info_ptr, length, eXIf_buf);
+   png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
 
-   png_free(png_ptr, eXIf_buf);
+   png_free(png_ptr, info_ptr->eXIf_buf);
+   info_ptr->eXIf_buf = NULL;
 }
 #endif