fix memory leaks in pdf_load_jpx and fz_new_image_from_pixmap

fz_new_image_from_pixmap expects that the pixmap's colorspace has two
references which is contrary to expectations. If it instead addrefs the
pixmap's colorspace, the only caller pdf_load_jpx can consistently
drop the colorspace after passing it to fz_load_jpx.

Also, if the contract is that whatever is passed into
fz_new_image_from_pixmap belongs to the new image, then the pixmap also
has to be dropped on error so that it isn't leaked.

1 files changed, 2 insertions, 1 deletions

diff --git a/source/fitz/image.c b/source/fitz/image.c
index 2144674a..f5af4539 100644
--- a/source/fitz/image.c
+++ b/source/fitz/image.c
@@ -340,7 +340,7 @@ fz_new_image_from_pixmap(fz_context *ctx, fz_pixmap *pixmap, fz_image *mask)
 		image->w = pixmap->w;
 		image->h = pixmap->h;
 		image->n = pixmap->n;
-		image->colorspace = pixmap->colorspace;
+		image->colorspace = fz_keep_colorspace(ctx, pixmap->colorspace);
 		image->bpc = 8;
 		image->buffer = NULL;
 		image->get_pixmap = fz_image_get_pixmap;
@@ -351,6 +351,7 @@ fz_new_image_from_pixmap(fz_context *ctx, fz_pixmap *pixmap, fz_image *mask)
 	}
 	fz_catch(ctx)
 	{
+		fz_drop_pixmap(ctx, pixmap);
 		fz_drop_image(ctx, mask);
 		fz_rethrow(ctx);
 	}