summaryrefslogtreecommitdiff
path: root/third_party/libtiff
diff options
context:
space:
mode:
Diffstat (limited to 'third_party/libtiff')
-rw-r--r--third_party/libtiff/0010-fix-leak-imagebegin.patch15
-rw-r--r--third_party/libtiff/README.pdfium1
-rw-r--r--third_party/libtiff/tif_getimage.c5
3 files changed, 17 insertions, 4 deletions
diff --git a/third_party/libtiff/0010-fix-leak-imagebegin.patch b/third_party/libtiff/0010-fix-leak-imagebegin.patch
new file mode 100644
index 0000000000..41aaf91a38
--- /dev/null
+++ b/third_party/libtiff/0010-fix-leak-imagebegin.patch
@@ -0,0 +1,15 @@
+diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c
+index 8523793..97fa94d 100644
+--- a/third_party/libtiff/tif_getimage.c
++++ b/third_party/libtiff/tif_getimage.c
+@@ -478,10 +478,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
+ return 1;
+
+ fail_return:
+- _TIFFfree( img->redcmap );
+- _TIFFfree( img->greencmap );
+- _TIFFfree( img->bluecmap );
+- img->redcmap = img->greencmap = img->bluecmap = NULL;
++ TIFFRGBAImageEnd(img);
+ return 0;
+ }
diff --git a/third_party/libtiff/README.pdfium b/third_party/libtiff/README.pdfium
index e0b4192e75..3842ea67c0 100644
--- a/third_party/libtiff/README.pdfium
+++ b/third_party/libtiff/README.pdfium
@@ -19,3 +19,4 @@ Local Modifications:
0007-uninitialized-value.patch: Fix potentially uninitialized dircount value
0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch: Fix a heap buffer overflow
0009-HeapBufferOverflow-PixarLogDecode.patch: Fix a heap buffer overflow
+0010-fix-leak-imagebegin: Fix a leak when TIFFRGBAImageBegin fails
diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c
index 85237937ec..97fa94dbe7 100644
--- a/third_party/libtiff/tif_getimage.c
+++ b/third_party/libtiff/tif_getimage.c
@@ -478,10 +478,7 @@ TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
return 1;
fail_return:
- _TIFFfree( img->redcmap );
- _TIFFfree( img->greencmap );
- _TIFFfree( img->bluecmap );
- img->redcmap = img->greencmap = img->bluecmap = NULL;
+ TIFFRGBAImageEnd(img);
return 0;
}