AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Double free in ~SkPictureData()

Browse Source 
On subpicture parsing failures we clean up all fPictureRefs entries
*and* delete the array itself.  But the destructor also deletes the
array => double free.

Alternatively, we can set fPictureCount to the number of successfully
parsed pictures such that the destructor handles all the cleanup.

BUG=515228
R=reed@google.com,mtklein@google.com

Review URL: https://codereview.chromium.org/1264503011
This commit is contained in:
fmalita 2015-07-29 14:40:06 -07:00 committed by Commit bot
parent 3ac6b7551d
commit 5479d3b569
1 changed files with 6 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/core/SkPictureData.cpp
View File

@ -373,26 +373,14 @@ bool SkPictureData::parseStreamTag(SkStream* stream,
}
} break;
case SK_PICT_PICTURE_TAG: {
fPictureCount = size;
fPictureRefs = SkNEW_ARRAY(const SkPicture*, fPictureCount);
bool success = true;
int i = 0;
for ( ; i < fPictureCount; i++) {
fPictureCount = 0;
fPictureRefs = SkNEW_ARRAY(const SkPicture*, size);
for (uint32_t i = 0; i < size; i++) {
fPictureRefs[i] = SkPicture::CreateFromStream(stream, proc);
if (NULL == fPictureRefs[i]) {
success = false;
break;
if (!fPictureRefs[i]) {
return false;
}
}
if (!success) {
// Delete all of the pictures that were already created (up to but excluding i):
for (int j = 0; j < i; j++) {
fPictureRefs[j]->unref();
}
// Delete the array
SkDELETE_ARRAY(fPictureRefs);
fPictureCount = 0;
return false;
fPictureCount++;
}
} break;
case SK_PICT_BUFFER_SIZE_TAG: {