third_party/libtiff/0015-fix-leaks-in-tif_ojpeg.diff


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

diff --git a/third_party/libtiff/tif_ojpeg.c b/third_party/libtiff/tif_ojpeg.c
index cc5449cd6..f69b00148 100644
--- a/third_party/libtiff/tif_ojpeg.c
+++ b/third_party/libtiff/tif_ojpeg.c
@@ -1790,7 +1790,10 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF* tif)
                        TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET); 
                        p=TIFFReadFile(tif,&ob[sizeof(uint32)+5],64);
                        if (p!=64)
+                       {
+                               _TIFFfree(ob);
                                return(0);
+                       }
                        sp->qtable[m]=ob;
                        sp->sof_tq[m]=m;
                }
@@ -1854,7 +1857,10 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF* tif)
                                rb[sizeof(uint32)+5+n]=o[n];
                        p=TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
                        if (p!=q)
+                       {
+                               _TIFFfree(rb);
                                return(0);
+                       }
                        sp->dctable[m]=rb;
                        sp->sos_tda[m]=(m<<4);
                }
@@ -1918,7 +1924,10 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF* tif)
                                rb[sizeof(uint32)+5+n]=o[n];
                        p=TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
                        if (p!=q)
+                       {
+                               _TIFFfree(rb);
                                return(0);
+                       }
                        sp->actable[m]=rb;
                        sp->sos_tda[m]=(sp->sos_tda[m]|m);
                }