fix memory leaks in pdf_load_jpx and fz_new_image_from_pixmap

fz_new_image_from_pixmap expects that the pixmap's colorspace has two
references which is contrary to expectations. If it instead addrefs the
pixmap's colorspace, the only caller pdf_load_jpx can consistently
drop the colorspace after passing it to fz_load_jpx.

Also, if the contract is that whatever is passed into
fz_new_image_from_pixmap belongs to the new image, then the pixmap also
has to be dropped on error so that it isn't leaked.

1 files changed, 6 insertions, 9 deletions

diff --git a/source/pdf/pdf-image.c b/source/pdf/pdf-image.c
index ef7f94ad..c329c1a7 100644
--- a/source/pdf/pdf-image.c
+++ b/source/pdf/pdf-image.c
@@ -216,12 +216,6 @@ pdf_load_jpx(pdf_document *doc, pdf_obj *dict, int forcemask)
 
 		img = fz_load_jpx(ctx, buf->data, buf->len, colorspace, indexed);
 
-		if (colorspace == NULL)
-			colorspace = fz_keep_colorspace(ctx, img->colorspace);
-
-		fz_drop_buffer(ctx, buf);
-		buf = NULL;
-
 		obj = pdf_dict_getsa(dict, "SMask", "Mask");
 		if (pdf_is_dict(obj))
 		{
@@ -243,14 +237,17 @@ pdf_load_jpx(pdf_document *doc, pdf_obj *dict, int forcemask)
 			fz_decode_tile(img, decode);
 		}
 	}
-	fz_catch(ctx)
+	fz_always(ctx)
 	{
-		if (colorspace)
-			fz_drop_colorspace(ctx, colorspace);
+		fz_drop_colorspace(ctx, colorspace);
 		fz_drop_buffer(ctx, buf);
+	}
+	fz_catch(ctx)
+	{
 		fz_drop_pixmap(ctx, img);
 		fz_rethrow(ctx);
 	}
+
 	return fz_new_image_from_pixmap(ctx, img, mask);
 }