Fix key_storable operations leading to leaks of fz_image.

key_storable objects can either be freed 'directly' by an API call
(such as fz_drop_image), or 'internally' by the store realising that
the sole thing holding onto a key_storable is a key.

The current code frees more structure in the direct call than it
does in the internal call. Clearly this is wrong and leads to
leaks.

The fix is to do ALL the freeing in the internal 'drop' function
within the key_storable.

This means we don't need (or want) either fz_drop_key_storable_key or
fz_drop_key_storable to return an int to tell us whether they were
actually dropped, so we make that change to simplify the code.

This shifts the responsibility for freeing the extra internal
structure into the innermost drop functions - fz_drop_image_imp and
fz_drop_image_gprf_imp. To avoid duplicating code, we put the
extra freeing logic into a fz_drop_image_base function.

1 files changed, 1 insertions, 0 deletions

diff --git a/source/gprf/gprf-doc.c b/source/gprf/gprf-doc.c
index 53816a15..23731867 100644
--- a/source/gprf/gprf-doc.c
+++ b/source/gprf/gprf-doc.c
@@ -175,6 +175,7 @@ fz_drop_image_gprf_imp(fz_context *ctx, fz_storable *image_)
 
 	fz_drop_gprf_file(ctx, image->file);
 	fz_drop_separations(ctx, image->separations);
+	fz_drop_image_base(ctx, image->super);
 }
 
 static inline unsigned char *cmyk_to_rgba(unsigned char *out, uint32_t c, uint32_t m, uint32_t y, uint32_t k)