Bug 693463: Fix various memory leaks.

All these leaks were spotted by zeniko, so credit/thanks to him.

5 files changed, 103 insertions, 56 deletions

diff --git a/fitz/base_xml.c b/fitz/base_xml.c
index c8635f93..d715259b 100644
--- a/fitz/base_xml.c
+++ b/fitz/base_xml.c
@@ -434,12 +434,22 @@ fz_parse_xml(fz_context *ctx, unsigned char *s, int n)
 
 	p = convert_to_utf8(ctx, s, n);
 
-	error = xml_parse_document_imp(&parser, p);
-	if (error)
-		fz_throw(ctx, "%s", error);
-
-	if (p != (char*)s)
-		fz_free(ctx, p);
+	fz_try(ctx)
+	{
+		error = xml_parse_document_imp(&parser, p);
+		if (error)
+			fz_throw(ctx, "%s", error);
+	}
+	fz_always(ctx)
+	{
+		if (p != (char*)s)
+			fz_free(ctx, p);
+	}
+	fz_catch(ctx)
+	{
+		fz_free_xml(ctx, root.down);
+		fz_rethrow(ctx);
+	}
 
 	return root.down;
 }
diff --git a/pdf/pdf_annot.c b/pdf/pdf_annot.c
index 99c13bd5..4d0d0f84 100644
--- a/pdf/pdf_annot.c
+++ b/pdf/pdf_annot.c
@@ -360,8 +360,9 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 	int i, len;
 	fz_context *ctx = xref->ctx;
 
+	fz_var(annot);
+
 	head = tail = NULL;
-	annot = NULL;
 
 	len = pdf_array_len(annots);
 	for (i = 0; i < len; i++)
@@ -374,7 +375,11 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 		ap = pdf_dict_gets(obj, "AP");
 		as = pdf_dict_gets(obj, "AS");
 
-		if (pdf_is_dict(ap))
+		if (!pdf_is_dict(ap))
+			continue;
+
+		annot = NULL;
+		fz_try(ctx)
 		{
 			pdf_hotspot *hp = &xref->hotspot;
 
@@ -394,7 +399,6 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 			if (!pdf_is_stream(xref, pdf_to_num(n), pdf_to_gen(n)))
 				n = pdf_dict_get(n, as);
 
-
 			annot = fz_malloc_struct(ctx, pdf_annot);
 			annot->obj = pdf_keep_obj(obj);
 			annot->rect = pdf_to_rect(ctx, rect);
@@ -404,16 +408,9 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 
 			if (pdf_is_stream(xref, pdf_to_num(n), pdf_to_gen(n)))
 			{
-				fz_try(ctx)
-				{
-					annot->ap = pdf_load_xobject(xref, n);
-					pdf_transform_annot(annot);
-					annot->ap_iteration = annot->ap->iteration;
-				}
-				fz_catch(ctx)
-				{
-					fz_warn(ctx, "ignoring broken annotation");
-				}
+				annot->ap = pdf_load_xobject(xref, n);
+				pdf_transform_annot(annot);
+				annot->ap_iteration = annot->ap->iteration;
 			}
 
 			annot->next = NULL;
@@ -429,6 +426,11 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 				tail = annot;
 			}
 		}
+		fz_catch(ctx)
+		{
+			fz_free(ctx, annot);
+			fz_warn(ctx, "ignoring broken annotation");
+		}
 	}
 
 	return head;
diff --git a/pdf/pdf_xobject.c b/pdf/pdf_xobject.c
index 4d7243b6..86b45167 100644
--- a/pdf/pdf_xobject.c
+++ b/pdf/pdf_xobject.c
@@ -57,46 +57,46 @@ pdf_load_xobject(pdf_document *xref, pdf_obj *dict)
 	/* Store item immediately, to avoid possible recursion if objects refer back to this one */
 	pdf_store_item(ctx, dict, form, pdf_xobject_size(form));
 
-	obj = pdf_dict_gets(dict, "BBox");
-	form->bbox = pdf_to_rect(ctx, obj);
-
-	obj = pdf_dict_gets(dict, "Matrix");
-	if (obj)
-		form->matrix = pdf_to_matrix(ctx, obj);
-	else
-		form->matrix = fz_identity;
-
-	form->isolated = 0;
-	form->knockout = 0;
-	form->transparency = 0;
-
-	obj = pdf_dict_gets(dict, "Group");
-	if (obj)
+	fz_try(ctx)
 	{
-		pdf_obj *attrs = obj;
+		obj = pdf_dict_gets(dict, "BBox");
+		form->bbox = pdf_to_rect(ctx, obj);
 
-		form->isolated = pdf_to_bool(pdf_dict_gets(attrs, "I"));
-		form->knockout = pdf_to_bool(pdf_dict_gets(attrs, "K"));
+		obj = pdf_dict_gets(dict, "Matrix");
+		if (obj)
+			form->matrix = pdf_to_matrix(ctx, obj);
+		else
+			form->matrix = fz_identity;
 
-		obj = pdf_dict_gets(attrs, "S");
-		if (pdf_is_name(obj) && !strcmp(pdf_to_name(obj), "Transparency"))
-			form->transparency = 1;
+		form->isolated = 0;
+		form->knockout = 0;
+		form->transparency = 0;
 
-		obj = pdf_dict_gets(attrs, "CS");
+		obj = pdf_dict_gets(dict, "Group");
 		if (obj)
 		{
-			form->colorspace = pdf_load_colorspace(xref, obj);
-			if (!form->colorspace)
-				fz_throw(ctx, "cannot load xobject colorspace");
+			pdf_obj *attrs = obj;
+
+			form->isolated = pdf_to_bool(pdf_dict_gets(attrs, "I"));
+			form->knockout = pdf_to_bool(pdf_dict_gets(attrs, "K"));
+	
+			obj = pdf_dict_gets(attrs, "S");
+			if (pdf_is_name(obj) && !strcmp(pdf_to_name(obj), "Transparency"))
+				form->transparency = 1;
+
+			obj = pdf_dict_gets(attrs, "CS");
+			if (obj)
+			{
+				form->colorspace = pdf_load_colorspace(xref, obj);
+				if (!form->colorspace)
+					fz_throw(ctx, "cannot load xobject colorspace");
+			}
 		}
-	}
 
-	form->resources = pdf_dict_gets(dict, "Resources");
-	if (form->resources)
-		pdf_keep_obj(form->resources);
+		form->resources = pdf_dict_gets(dict, "Resources");
+		if (form->resources)
+			pdf_keep_obj(form->resources);
 
-	fz_try(ctx)
-	{
 		form->contents = pdf_keep_obj(dict);
 	}
 	fz_catch(ctx)
diff --git a/xps/xps_doc.c b/xps/xps_doc.c
index 8c86fd59..4fefceb3 100644
--- a/xps/xps_doc.c
+++ b/xps/xps_doc.c
@@ -366,12 +366,25 @@ xps_parse_metadata(xps_document *doc, xps_part *part, xps_fixdoc *fixdoc)
 static void
 xps_read_and_process_metadata_part(xps_document *doc, char *name, xps_fixdoc *fixdoc)
 {
-	if (xps_has_part(doc, name))
+	fz_context *ctx = doc->ctx;
+	xps_part *part;
+
+	if (!xps_has_part(doc, name))
+		return;
+
+	part = xps_read_part(doc, name);
+	fz_try(ctx)
 	{
-		xps_part *part = xps_read_part(doc, name);
 		xps_parse_metadata(doc, part, fixdoc);
+	}
+	fz_always(ctx)
+	{
 		xps_free_part(doc, part);
 	}
+	fz_catch(ctx)
+	{
+		fz_rethrow(ctx);
+	}
 }
 
 void
@@ -415,10 +428,21 @@ xps_load_fixed_page(xps_document *doc, xps_page *page)
 	fz_xml *root;
 	char *width_att;
 	char *height_att;
+	fz_context *ctx = doc->ctx;
 
 	part = xps_read_part(doc, page->name);
-	root = fz_parse_xml(doc->ctx, part->data, part->size);
-	xps_free_part(doc, part);
+	fz_try(ctx)
+	{
+		root = fz_parse_xml(doc->ctx, part->data, part->size);
+	}
+	fz_always(ctx)
+	{
+		xps_free_part(doc, part);
+	}
+	fz_catch(ctx)
+	{
+		root = NULL;
+	}
 	if (!root)
 		fz_throw(doc->ctx, "FixedPage missing root element");
 
diff --git a/xps/xps_resource.c b/xps/xps_resource.c
index ffbce2d3..b94b6d3e 100644
--- a/xps/xps_resource.c
+++ b/xps/xps_resource.c
@@ -60,12 +60,23 @@ xps_parse_remote_resource_dictionary(xps_document *doc, char *base_uri, char *so
 	xps_part *part;
 	fz_xml *xml;
 	char *s;
+	fz_context *ctx = doc->ctx;
 
 	/* External resource dictionaries MUST NOT reference other resource dictionaries */
 	xps_resolve_url(part_name, base_uri, source_att, sizeof part_name);
 	part = xps_read_part(doc, part_name);
-	xml = fz_parse_xml(doc->ctx, part->data, part->size);
-	xps_free_part(doc, part);
+	fz_try(ctx)
+	{
+		xml = fz_parse_xml(doc->ctx, part->data, part->size);
+	}
+	fz_always(ctx)
+	{
+		xps_free_part(doc, part);
+	}
+	fz_catch(ctx)
+	{
+		xml = NULL;
+	}
 
 	if (!xml)
 		return NULL;