AuroraMiddleware/libpng
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix memory leak if eXIf has incorrect crc

Browse Source 
Problem description:
Imagine a bitstream with an eXIf data segment that has invalid CRC.
If png_crc_finish() fails at line 2090, info_ptr->eXIf_buf is not freed
(despite the free_me setting at line 2062) because png_free_data() is
not called. png_read_info() is actually looping several time over the
png_eXIf chunk, calling png_handle_eXIf() several time in a row without
freeing the buffer.

This patch fixes the problem by leaving info_ptr's content in a clean
state in case of failure, as it is done at line 2084.
This commit is contained in:
skal 2019-07-29 15:22:06 +02:00 committed by Cosmin Truta
parent 9f734b13f4
commit eb6767273a
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pngrutil.c
View File

@ -2087,10 +2087,8 @@ png_handle_eXIf(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
}
}
if (png_crc_finish(png_ptr, 0) != 0)
return;
png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
if (png_crc_finish(png_ptr, 0) == 0)
png_set_eXIf_1(png_ptr, info_ptr, length, info_ptr->eXIf_buf);
png_free(png_ptr, info_ptr->eXIf_buf);
info_ptr->eXIf_buf = NULL;