2011.02.22 09:54 "[Tiff] memory leak in tif_getimage.c", by Peter Hoepfner

2011.02.22 09:54 "[Tiff] memory leak in tif_getimage.c", by Peter Hoepfner

Hi,

I've discovered a memory leak in tif_getimage.c if TIFFRGBAImageBegin()
returns an error. All resources already acquired are not released. I've
created a patch to fix this leak.

Sincerely Peter Hoepfner

---------------------------------------------------------------------------------------------------------------------

*** libtiff/tif_getimage.c.3.9.4    2011-02-22 10:40:49.000000000 +0100

--- libtiff/tif_getimage.c    2011-02-22 10:43:34.000000000 +0100

***************
*** 206,211 ****
--- 206,212 ----
           _TIFFfree( img->redcmap );
           _TIFFfree( img->greencmap );
           _TIFFfree( img->bluecmap );
+ img->redcmap = img->greencmap = img->bluecmap = NULL;
       }
   }

***************
*** 474,489 ****
       TIFFRGBAImage img;
       int ok;

       if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif,
stop, emsg)) {
           img.req_orientation = orientation;
           /* XXX verify rwidth and rheight against width and height */
           ok = TIFFRGBAImageGet(&img, raster+(rheight-img.height)*rwidth,
               rwidth, img.height);
- TIFFRGBAImageEnd(&img);
       } else {
           TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
           ok = 0;
       }
       return (ok);
   }

--- 475,491 ----
       TIFFRGBAImage img;
       int ok;

+     _TIFFmemset(&img, 0, sizeof(TIFFRGBAImage));

       if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif,
stop, emsg)) {
           img.req_orientation = orientation;
           /* XXX verify rwidth and rheight against width and height */
           ok = TIFFRGBAImageGet(&img, raster+(rheight-img.height)*rwidth,
               rwidth, img.height);
       } else {
           TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
           ok = 0;
       }
+ TIFFRGBAImageEnd(&img);
       return (ok);
   }

***************
*** 2541,2546 ****
--- 2543,2549 ----
           return (0);
       }

+     _TIFFmemset(&img, 0, sizeof(TIFFRGBAImage));

       if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif,
0, emsg)) {

           img.row_offset = row;
***************
*** 2553,2563 ****

ok = TIFFRGBAImageGet(&img, raster, img.width, rows_to_read );

- TIFFRGBAImageEnd(&img);
       } else {
           TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
           ok = 0;
       }

       return (ok);
   }
--- 2556,2566 ----

ok = TIFFRGBAImageGet(&img, raster, img.width, rows_to_read );

       } else {
           TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
           ok = 0;
       }
+ TIFFRGBAImageEnd(&img);

       return (ok);
   }
***************
*** 2605,2612 ****
--- 2608,2617 ----
        * Setup the RGBA reader.
        */

+     _TIFFmemset(&img, 0, sizeof(TIFFRGBAImage));

       if (!TIFFRGBAImageOK(tif, emsg)
       || !TIFFRGBAImageBegin(&img, tif, 0, emsg)) {

+ TIFFRGBAImageEnd(&img);
           TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", emsg);
           return( 0 );
       }