Drop JPEG/J2K/JPEG-XR/PNG/TIFF colorspaces even upon exception.

For TIFF it was not just the colorspace, but other data as well.

5 files changed, 30 insertions, 16 deletions

diff --git a/source/fitz/load-jpeg.c b/source/fitz/load-jpeg.c
index b088325b..87b32431 100644
--- a/source/fitz/load-jpeg.c
+++ b/source/fitz/load-jpeg.c
@@ -379,7 +379,7 @@ fz_load_jpeg_info(fz_context *ctx, const unsigned char *rbuf, size_t rlen, int *
 	struct jpeg_decompress_struct cinfo;
 	struct jpeg_error_mgr err;
 	struct jpeg_source_mgr src;
-	fz_colorspace *icc;
+	fz_colorspace *icc = NULL;
 
 	fz_try(ctx)
 	{
@@ -453,6 +453,7 @@ fz_load_jpeg_info(fz_context *ctx, const unsigned char *rbuf, size_t rlen, int *
 	}
 	fz_catch(ctx)
 	{
+		fz_drop_colorspace(ctx, icc);
 		fz_rethrow(ctx);
 	}
 }
diff --git a/source/fitz/load-jpx.c b/source/fitz/load-jpx.c
index 178be392..40a0a8c7 100644
--- a/source/fitz/load-jpx.c
+++ b/source/fitz/load-jpx.c
@@ -923,7 +923,7 @@ fz_load_jpx_info(fz_context *ctx, const unsigned char *data, size_t size, int *w
 	fz_catch(ctx)
 		fz_rethrow(ctx);
 
-	*cspacep = state.cs;
+	*cspacep = fz_keep_colorspace(ctx, state.cs);
 	*wp = state.width;
 	*hp = state.height;
 	*xresp = state.xres;
diff --git a/source/fitz/load-jxr.c b/source/fitz/load-jxr.c
index 789fcfe6..f603ee57 100644
--- a/source/fitz/load-jxr.c
+++ b/source/fitz/load-jxr.c
@@ -401,15 +401,15 @@ fz_load_jxr(fz_context *ctx, const unsigned char *data, size_t size)
 
 	fz_var(image);
 
-	jxr_read_image(ctx, data, size, &info, 0);
+	fz_try(ctx)
+	{
+		jxr_read_image(ctx, data, size, &info, 0);
 
-	image = fz_new_pixmap(ctx, info.cspace, info.width, info.height, NULL, 1);
+		image = fz_new_pixmap(ctx, info.cspace, info.width, info.height, NULL, 1);
 
-	image->xres = info.xres;
-	image->yres = info.yres;
+		image->xres = info.xres;
+		image->yres = info.yres;
 
-	fz_try(ctx)
-	{
 		fz_unpack_tile(ctx, image, info.samples, fz_colorspace_n(ctx, info.cspace) + 1, 8, info.stride, 0);
 		if (info.has_alpha && !info.has_premul)
 			fz_premultiply_pixmap(ctx, image);
@@ -417,7 +417,6 @@ fz_load_jxr(fz_context *ctx, const unsigned char *data, size_t size)
 	fz_always(ctx)
 	{
 		fz_free(ctx, info.samples);
-		fz_drop_colorspace(ctx, info.cspace);
 	}
 	fz_catch(ctx)
 	{
diff --git a/source/fitz/load-png.c b/source/fitz/load-png.c
index 179297a3..55dd8fe7 100644
--- a/source/fitz/load-png.c
+++ b/source/fitz/load-png.c
@@ -503,6 +503,7 @@ png_read_image(fz_context *ctx, struct info *info, const unsigned char *p, size_
 		{
 			inflateEnd(&stm);
 			fz_free(ctx, info->samples);
+			info->samples = NULL;
 		}
 		fz_rethrow(ctx);
 	}
@@ -513,6 +514,7 @@ png_read_image(fz_context *ctx, struct info *info, const unsigned char *p, size_
 		if (code != Z_OK)
 		{
 			fz_free(ctx, info->samples);
+			info->samples = NULL;
 			fz_throw(ctx, FZ_ERROR_GENERIC, "zlib error: %s", stm.msg);
 		}
 
@@ -527,6 +529,7 @@ png_read_image(fz_context *ctx, struct info *info, const unsigned char *p, size_
 		fz_catch(ctx)
 		{
 			fz_free(ctx, info->samples);
+			info->samples = NULL;
 			fz_rethrow(ctx);
 		}
 	}
@@ -614,13 +617,13 @@ fz_load_png(fz_context *ctx, const unsigned char *p, size_t total)
 
 	fz_var(image);
 
-	png_read_image(ctx, &png, p, total, 0);
-
-	stride = (png.width * png.n * png.depth + 7) / 8;
-	alpha = (png.n == 2 || png.n == 4 || png.transparency);
-
 	fz_try(ctx)
 	{
+		png_read_image(ctx, &png, p, total, 0);
+
+		stride = (png.width * png.n * png.depth + 7) / 8;
+		alpha = (png.n == 2 || png.n == 4 || png.transparency);
+
 		if (png.indexed)
 		{
 			image = fz_new_pixmap(ctx, NULL, png.width, png.height, NULL, 1);
@@ -657,7 +660,13 @@ fz_load_png_info(fz_context *ctx, const unsigned char *p, size_t total, int *wp,
 {
 	struct info png;
 
-	png_read_image(ctx, &png, p, total, 1);
+	fz_try(ctx)
+		png_read_image(ctx, &png, p, total, 1);
+	fz_catch(ctx)
+	{
+		fz_drop_colorspace(ctx, png.cs);
+		fz_rethrow(ctx);
+	}
 
 	*cspacep = png.cs;
 	*wp = png.width;
diff --git a/source/fitz/load-tiff.c b/source/fitz/load-tiff.c
index 80abd6f1..2da9e635 100644
--- a/source/fitz/load-tiff.c
+++ b/source/fitz/load-tiff.c
@@ -1374,6 +1374,7 @@ fz_load_tiff_subimage(fz_context *ctx, const unsigned char *buf, size_t len, int
 	fz_always(ctx)
 	{
 		/* Clean up scratch memory */
+		fz_drop_colorspace(ctx, tiff.colorspace);
 		fz_free(ctx, tiff.colormap);
 		fz_free(ctx, tiff.stripoffsets);
 		fz_free(ctx, tiff.stripbytecounts);
@@ -1420,14 +1421,18 @@ fz_load_tiff_info_subimage(fz_context *ctx, const unsigned char *buf, size_t len
 			fz_drop_colorspace(ctx, tiff.colorspace);
 			tiff.colorspace = fz_keep_colorspace(ctx, fz_device_rgb(ctx));
 		}
-		*cspacep = tiff.colorspace;
+		*cspacep = fz_keep_colorspace(ctx, tiff.colorspace);
 	}
 	fz_always(ctx)
 	{
 		/* Clean up scratch memory */
+		fz_drop_colorspace(ctx, tiff.colorspace);
 		fz_free(ctx, tiff.colormap);
 		fz_free(ctx, tiff.stripoffsets);
 		fz_free(ctx, tiff.stripbytecounts);
+		fz_free(ctx, tiff.tileoffsets);
+		fz_free(ctx, tiff.tilebytecounts);
+		fz_free(ctx, tiff.data);
 		fz_free(ctx, tiff.samples);
 		fz_free(ctx, tiff.profile);
 	}