diff options
| author | kcwu <kcwu@chromium.org> | 2016-09-22 18:26:22 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-09-22 18:26:22 -0700 |
| commit | 39ee9dfac1c6d286a4075c7e2435fe1cfe365bad (patch) | |
| tree | bd2ff8c788b1411ee34d84e1c47d50f251a5cf01 /third_party/lcms2-2.6/0006-memory-leak-Type_NamedColor_Read.patch | |
| parent | fe0179ded8202939ea4f2b92a879b8dede7821ea (diff) | |
| download | pdfium-39ee9dfac1c6d286a4075c7e2435fe1cfe365bad.tar.xz | |
Fix memory leaks in lcms
found by libfuzzer
Review-Url: https://codereview.chromium.org/2359243003
Diffstat (limited to 'third_party/lcms2-2.6/0006-memory-leak-Type_NamedColor_Read.patch')
| -rw-r--r-- | third_party/lcms2-2.6/0006-memory-leak-Type_NamedColor_Read.patch | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/third_party/lcms2-2.6/0006-memory-leak-Type_NamedColor_Read.patch b/third_party/lcms2-2.6/0006-memory-leak-Type_NamedColor_Read.patch new file mode 100644 index 0000000000..5d25d5a737 --- /dev/null +++ b/third_party/lcms2-2.6/0006-memory-leak-Type_NamedColor_Read.patch @@ -0,0 +1,22 @@ +diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c +index feba387..4d24fc2 100644 +--- a/third_party/lcms2-2.6/src/cmstypes.c ++++ b/third_party/lcms2-2.6/src/cmstypes.c +@@ -3102,7 +3102,7 @@ void *Type_NamedColor_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* i + + if (nDeviceCoords > cmsMAXCHANNELS) { + cmsSignalError(self->ContextID, cmsERROR_RANGE, "Too many device coordinates '%d'", nDeviceCoords); +- return 0; ++ goto Error; + } + for (i=0; i < count; i++) { + +@@ -3111,7 +3111,7 @@ void *Type_NamedColor_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* i + char Root[33]; + + memset(Colorant, 0, sizeof(Colorant)); +- if (io -> Read(io, Root, 32, 1) != 1) return NULL; ++ if (io -> Read(io, Root, 32, 1) != 1) goto Error; + Root[32] = 0; + if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error; + if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error; |