diff options
| author | kcwu <kcwu@chromium.org> | 2016-09-22 18:26:22 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-09-22 18:26:22 -0700 |
| commit | 39ee9dfac1c6d286a4075c7e2435fe1cfe365bad (patch) | |
| tree | bd2ff8c788b1411ee34d84e1c47d50f251a5cf01 /third_party/lcms2-2.6/0004-memory-leak-Type_Curve_Read.patch | |
| parent | fe0179ded8202939ea4f2b92a879b8dede7821ea (diff) | |
| download | pdfium-39ee9dfac1c6d286a4075c7e2435fe1cfe365bad.tar.xz | |
Fix memory leaks in lcms
found by libfuzzer
Review-Url: https://codereview.chromium.org/2359243003
Diffstat (limited to 'third_party/lcms2-2.6/0004-memory-leak-Type_Curve_Read.patch')
| -rw-r--r-- | third_party/lcms2-2.6/0004-memory-leak-Type_Curve_Read.patch | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/third_party/lcms2-2.6/0004-memory-leak-Type_Curve_Read.patch b/third_party/lcms2-2.6/0004-memory-leak-Type_Curve_Read.patch new file mode 100644 index 0000000000..341a1c6b47 --- /dev/null +++ b/third_party/lcms2-2.6/0004-memory-leak-Type_Curve_Read.patch @@ -0,0 +1,28 @@ +diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c +index 06742b5..9fe5e2a 100644 +--- a/third_party/lcms2-2.6/src/cmstypes.c ++++ b/third_party/lcms2-2.6/src/cmstypes.c +@@ -1112,7 +1112,10 @@ void *Type_Curve_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cm + NewGamma = cmsBuildTabulatedToneCurve16(self ->ContextID, Count, NULL); + if (!NewGamma) return NULL; + +- if (!_cmsReadUInt16Array(io, Count, NewGamma -> Table16)) return NULL; ++ if (!_cmsReadUInt16Array(io, Count, NewGamma -> Table16)) { ++ cmsFreeToneCurve(NewGamma); ++ return NULL; ++ } + + *nItems = 1; + return NewGamma; +@@ -2350,7 +2353,10 @@ cmsStage* ReadCLUT(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsUI + + for (i=0; i < Data ->nEntries; i++) { + +- if (io ->Read(io, &v, sizeof(cmsUInt8Number), 1) != 1) return NULL; ++ if (io ->Read(io, &v, sizeof(cmsUInt8Number), 1) != 1) { ++ cmsStageFree(CLUT); ++ return NULL; ++ } + Data ->Tab.T[i] = FROM_8_TO_16(v); + } + |