More Memory squeezing fixes

4 files changed, 39 insertions, 13 deletions

diff --git a/fitz/res_path.c b/fitz/res_path.c
index 054b3c1f..bf61cff6 100644
--- a/fitz/res_path.c
+++ b/fitz/res_path.c
@@ -49,11 +49,13 @@ fz_free_path(fz_context *ctx, fz_path *path)
 static void
 grow_path(fz_context *ctx, fz_path *path, int n)
 {
-	if (path->len + n < path->cap)
+	int newcap = path->cap;
+	if (path->len + n <= path->cap)
 		return;
-	while (path->len + n > path->cap)
-		path->cap = path->cap + 36;
-	path->items = fz_resize_array(ctx, path->items, path->cap, sizeof(fz_path_item));
+	while (path->len + n > newcap)
+		newcap = newcap + 36;
+	path->items = fz_resize_array(ctx, path->items, newcap, sizeof(fz_path_item));
+	path->cap = newcap;
 }
 
 void
diff --git a/fitz/res_pixmap.c b/fitz/res_pixmap.c
index 99132a31..2ab95678 100644
--- a/fitz/res_pixmap.c
+++ b/fitz/res_pixmap.c
@@ -446,12 +446,17 @@ fz_write_png(fz_context *ctx, fz_pixmap *pixmap, char *filename, int savealpha)
 	static const unsigned char pngsig[8] = { 137, 80, 78, 71, 13, 10, 26, 10 };
 	FILE *fp;
 	unsigned char head[13];
-	unsigned char *udata, *cdata, *sp, *dp;
+	unsigned char *udata = NULL;
+	unsigned char *cdata = NULL;
+	unsigned char *sp, *dp;
 	uLong usize, csize;
 	int y, x, k, sn, dn;
 	int color;
 	int err;
 
+	fz_var(udata);
+	fz_var(cdata);
+
 	if (pixmap->n != 1 && pixmap->n != 2 && pixmap->n != 4)
 		fz_throw(ctx, "pixmap must be grayscale or rgb to write as png");
 
@@ -471,8 +476,16 @@ fz_write_png(fz_context *ctx, fz_pixmap *pixmap, char *filename, int savealpha)
 
 	usize = (pixmap->w * dn + 1) * pixmap->h;
 	csize = compressBound(usize);
-	udata = fz_malloc(ctx, usize);
-	cdata = fz_malloc(ctx, csize);
+	fz_try(ctx)
+	{
+		udata = fz_malloc(ctx, usize);
+		cdata = fz_malloc(ctx, csize);
+	}
+	fz_catch(ctx)
+	{
+		fz_free(ctx, udata);
+		fz_rethrow(ctx);
+	}
 
 	sp = pixmap->samples;
 	dp = udata;
diff --git a/fitz/res_text.c b/fitz/res_text.c
index b8c5c5fd..63338435 100644
--- a/fitz/res_text.c
+++ b/fitz/res_text.c
@@ -19,8 +19,11 @@ fz_new_text(fz_context *ctx, fz_font *font, fz_matrix trm, int wmode)
 void
 fz_free_text(fz_context *ctx, fz_text *text)
 {
-	fz_drop_font(ctx, text->font);
-	fz_free(ctx, text->items);
+	if (text != NULL)
+	{
+		fz_drop_font(ctx, text->font);
+		fz_free(ctx, text->items);
+	}
 	fz_free(ctx, text);
 }
 
@@ -30,13 +33,21 @@ fz_clone_text(fz_context *ctx, fz_text *old)
 	fz_text *text;
 
 	text = fz_malloc_struct(ctx, fz_text);
+	text->len = old->len;
+	fz_try(ctx)
+	{
+		text->items = fz_malloc_array(ctx, text->len, sizeof(fz_text_item));
+	}
+	fz_catch(ctx)
+	{
+		fz_free(ctx, text);
+		fz_rethrow(ctx);
+	}
+	memcpy(text->items, old->items, text->len * sizeof(fz_text_item));
 	text->font = fz_keep_font(old->font);
 	text->trm = old->trm;
 	text->wmode = old->wmode;
-	text->len = old->len;
 	text->cap = text->len;
-	text->items = fz_malloc_array(ctx, text->len, sizeof(fz_text_item));
-	memcpy(text->items, old->items, text->len * sizeof(fz_text_item));
 
 	return text;
 }
diff --git a/fitz/stm_read.c b/fitz/stm_read.c
index 3d76d51a..2066b14c 100644
--- a/fitz/stm_read.c
+++ b/fitz/stm_read.c
@@ -90,7 +90,7 @@ fz_fill_buffer(fz_stream *stm)
 fz_buffer *
 fz_read_all(fz_stream *stm, int initial)
 {
-	fz_buffer *buf;
+	fz_buffer *buf = NULL;
 	int n;
 	fz_context *ctx = stm->ctx;