Fix XPS leaking fz_buffers for images.

fz_new_image_from_buffer was building a new buffer from the data in
the supplied buffer, rather than just using the supplied buffer. Also
move the code into line with our standards; don't pass ownership of
the buffer.

2 files changed, 27 insertions, 9 deletions

diff --git a/fitz/res_image.c b/fitz/res_image.c
index 0454f6bd..4aac14ae 100644
--- a/fitz/res_image.c
+++ b/fitz/res_image.c
@@ -417,9 +417,29 @@ fz_new_image(fz_context *ctx, int w, int h, int bpc, fz_colorspace *colorspace,
 fz_image *
 fz_new_image_from_data(fz_context *ctx, unsigned char *data, int len)
 {
-	fz_buffer *buffer = fz_new_buffer_from_data(ctx, data, len);
+	fz_buffer *buffer = NULL;
+	fz_image *image;
+
+	fz_var(buffer);
+	fz_var(data);
+
+	fz_try(ctx)
+	{
+		buffer = fz_new_buffer_from_data(ctx, data, len);
+		data = NULL;
+		image = fz_new_image_from_buffer(ctx, buffer);
+	}
+	fz_always(ctx)
+	{
+		fz_drop_buffer(ctx, buffer);
+	}
+	fz_catch(ctx)
+	{
+		fz_free(ctx, data);
+		fz_rethrow(ctx);
+	}
 
-	return fz_new_image_from_buffer(ctx, buffer);
+	return image;
 }
 
 fz_image *
@@ -428,12 +448,10 @@ fz_new_image_from_buffer(fz_context *ctx, fz_buffer *buffer)
 	fz_compressed_buffer *bc = NULL;
 	int w, h, xres, yres;
 	fz_colorspace *cspace;
-	fz_buffer *drop_buffer = buffer;
 	int len = buffer->len;
 	unsigned char *buf = buffer->data;
 
 	fz_var(bc);
-	fz_var(drop_buffer);
 
 	fz_try(ctx)
 	{
@@ -441,8 +459,7 @@ fz_new_image_from_buffer(fz_context *ctx, fz_buffer *buffer)
 			fz_throw(ctx, "unknown image file format");
 
 		bc = fz_malloc_struct(ctx, fz_compressed_buffer);
-		bc->buffer = fz_new_buffer_from_data(ctx, buf, len);
-		drop_buffer = NULL;
+		bc->buffer = fz_keep_buffer(ctx, buffer);
 
 		if (buf[0] == 0xff && buf[1] == 0xd8)
 		{
@@ -467,7 +484,6 @@ fz_new_image_from_buffer(fz_context *ctx, fz_buffer *buffer)
 	}
 	fz_catch(ctx)
 	{
-		fz_drop_buffer(ctx, drop_buffer);
 		fz_free_compressed_buffer(ctx, bc);
 		fz_rethrow(ctx);
 	}
diff --git a/image/muimage.c b/image/muimage.c
index 0577f1c5..6df668e2 100644
--- a/image/muimage.c
+++ b/image/muimage.c
@@ -33,11 +33,13 @@ image_open_document_with_stream(fz_context *ctx, fz_stream *file)
 	{
 		buffer = fz_read_all(doc->file, 1024);
 		doc->image = fz_new_image_from_buffer(ctx, buffer);
-		buffer = NULL;
 	}
-	fz_catch(ctx)
+	fz_always(ctx)
 	{
 		fz_drop_buffer(ctx, buffer);
+	}
+	fz_catch(ctx)
+	{
 		image_close_document(doc);
 		fz_rethrow(ctx);
 	}