[libpng16] Eliminate local eXIf_buf from png_handle_eXIf()

This commit is contained in:
Glenn Randers-Pehrson 2017-08-02 06:35:15 -05:00
parent 821b1dcf34
commit fd6b87253c

View File

@ -2015,8 +2015,6 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
{ {
unsigned int i; unsigned int i;
png_bytep eXIf_buf;
png_debug(1, "in png_handle_eXIf"); png_debug(1, "in png_handle_eXIf");
if ((png_ptr->mode & PNG_HAVE_IHDR) == 0) if ((png_ptr->mode & PNG_HAVE_IHDR) == 0)
@ -2029,32 +2027,31 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
return; return;
} }
eXIf_buf = png_voidcast(png_bytep, info_ptr->eXIf_buf = png_voidcast(png_bytep,
png_malloc_warn(png_ptr, length)); png_malloc_warn(png_ptr, length));
if (eXIf_buf == NULL) if (info_ptr->eXIf_buf == NULL)
{ {
png_crc_finish(png_ptr, length); png_crc_finish(png_ptr, length);
png_chunk_benign_error(png_ptr, "out of memory"); png_chunk_benign_error(png_ptr, "out of memory");
return; return;
} }
info_ptr->eXIf_buf = eXIf_buf; /* So it will be freed on error */
info_ptr->free_me |= PNG_FREE_EXIF; info_ptr->free_me |= PNG_FREE_EXIF;
for (i = 0; i < length; i++) for (i = 0; i < length; i++)
{ {
png_byte buf[1]; png_byte buf[1];
png_crc_read(png_ptr, buf, 1); png_crc_read(png_ptr, buf, 1);
eXIf_buf[i] = buf[0]; info_ptr->eXIf_buf[i] = buf[0];
} }
info_ptr->eXIf_buf = NULL;
if (png_crc_finish(png_ptr, 0) != 0) if (png_crc_finish(png_ptr, 0) != 0)
return; return;
png_set_eXIf_1(png_ptr, info_ptr, length, eXIf_buf); png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
png_free(png_ptr, eXIf_buf); png_free(png_ptr, info_ptr->eXIf_buf);
info_ptr->eXIf_buf = NULL;
} }
#endif #endif