search for: g_malloc

hi, this patch checks the returns of most malloc functions called in swfdec/jpeg. This should fix bug #15528. Don't know if you like gotos :) This incorporates the patch attached to message "[PATCH] fix leak in jpeg_decode_argb". thanks, rm -------------- next part -------------- A non-text attachment was scrubbed... Name: check-malloc-return.diff Type: text/x-diff Size: 3922

...radient * -swfdec_bits_do_get_gradient (SwfdecBits *bits, gboolean alpha) +swfdec_bits_do_get_gradient (SwfdecBits *bits, gboolean alpha, gboolean morph) { SwfdecGradient *grad; guint i, n_gradients; n_gradients = swfdec_bits_get_u8 (bits); + if (morph) + n_gradients *= 2; grad = g_malloc (sizeof (SwfdecGradient) + sizeof (SwfdecGradientEntry) * (MAX (n_gradients, 1) - 1)); for (i = 0; i < n_gradients && swfdec_bits_left (bits); i++) { @@ -625,35 +627,19 @@ swfdec_bits_do_get_gradient (SwfdecBits SwfdecGradient * swfdec_bits_get_gradient (SwfdecBits * bits)...

...n no more bits are available diff --git a/libswfdec/swfdec_bits.c b/libswfdec/swfdec_bits.c index 0f7e4c9..7077cdc 100644 --- a/libswfdec/swfdec_bits.c +++ b/libswfdec/swfdec_bits.c @@ -585,11 +585,15 @@ swfdec_bits_get_gradient (SwfdecBits * b n_gradients = swfdec_bits_get_u8 (bits); grad = g_malloc (sizeof (SwfdecGradient) + sizeof (SwfdecGradientEntry) * (n_gradients - 1)); - grad->n_gradients = n_gradients; - for (i = 0; i < n_gradients; i++) { + for (i = 0; i < n_gradients && swfdec_bits_left (bits); i++) { grad->array[i].ratio = swfdec_bits_get_u8 (bits)...

...g_return_if_fail (SWFDEC_IS_AS_FRAME (frame)); g_return_if_fail (try_data != NULL); @@ -2619,13 +2619,13 @@ swfdec_action_try_end_catch (SwfdecAsFrame *frame, gpointer data) // create new block for finally, passing the exception // clear exception from the context - exception = g_malloc (sizeof (SwfdecAsValue)); - *exception = val; + exception_value = g_malloc (sizeof (SwfdecAsValue)); + *exception_value = val; // FIXME: the exception value is not marked while finally block runs swfdec_as_frame_push_block (frame, try_data->finally_start, try_data->fina...

...swfdec_action_try_data_ref (try_data); swfdec_as_frame_pop_block (frame); - if (cx->throwing) { + if (cx->throwing) + { + // we got an exception while in catch block: + // create new block for finally, passing the exception + // clear exception from the context + error = g_malloc (sizeof (SwfdecAsValue)); *error = cx->throw_value; @@ -2611,7 +2634,7 @@ swfdec_action_try_end_catch (SwfdecAsFrame *frame, gpointer data) SWFDEC_AS_VALUE_SET_UNDEFINED (&cx->throw_value); } - swfdec_action_try_free_data (try_data); + swfdec_action_try_data_unref (try_...

...les/gnome/gtkconsole.c Wed Jul 10 16:21:30 2002 *************** *** 299,312 **** /* add command to history */ term_ptr = strchr (text_chars, '\n'); if ((add_to_history == TRUE) && (term_ptr != NULL) && (*text_chars != '\n')) ! { ! history_buf = g_malloc (term_ptr - text_chars + 1); ! *term_ptr = '\0'; ! strncpy (history_buf, text_chars, term_ptr - text_chars + 1); ! GTK_CONSOLE (object)->history = ! g_list_prepend (GTK_CONSOLE (object)->history, history_buf); ! GTK_CONSOLE (object)->history_num_items++;...

...uint8 *data; int have_alpha = (image->type == SWFDEC_IMAGE_TYPE_LOSSLESS2); swfdec_bits_init (&bits, image->raw_data); @@ -348,15 +357,14 @@ swfdec_image_lossless_load (SwfdecImage *image) guint i; guint rowstride = (image->width + 3) & ~3; - image->data = g_malloc (4 * image->width * image->height); - image->rowstride = image->width * 4; + data = g_malloc (4 * image->width * image->height); if (have_alpha) { buffer = swfdec_bits_decompress (&bits, -1, color_table_size * 4 + rowstride * image->height); if (b...

...height); - ptr = lossless (bits.ptr, endptr - bits.ptr, &len); - bits.ptr = endptr; if (format == 3) { - unsigned char *color_table; unsigned char *indexed_data; - int i; + guint i; + unsigned int rowstride = (image->width + 3) & ~3; - image_data = g_malloc (4 * image->width * image->height); + image->data = g_malloc (4 * image->width * image->height); image->rowstride = image->width * 4; - color_table = g_malloc (color_table_size * 4); - if (have_alpha) { + ptr = lossless (bits.ptr, bits.end - bits.p...

...+ char *filename = NULL; > + int fd, idx; > + struct stat stbuf; > + struct pstore_read_arg *rarg = NULL; > + Error *err = NULL; > + int ret = -1; > + > + if (s->file_idx >= s->num_file) { > + return 0; > + } > + > + rarg = g_malloc(sizeof(*rarg)); > + if (rarg == NULL) { > + return -1; > + } > + > + idx = s->file_idx++; > + filename = virtio_pstore_from_filename(s, s->files[idx]->d_name, > + &rarg->info); > + if (filename =...

...+ char *filename = NULL; > + int fd, idx; > + struct stat stbuf; > + struct pstore_read_arg *rarg = NULL; > + Error *err = NULL; > + int ret = -1; > + > + if (s->file_idx >= s->num_file) { > + return 0; > + } > + > + rarg = g_malloc(sizeof(*rarg)); > + if (rarg == NULL) { > + return -1; > + } > + > + idx = s->file_idx++; > + filename = virtio_pstore_from_filename(s, s->files[idx]->d_name, > + &rarg->info); > + if (filename =...

...data2 += 2; - length2 -= 2; - } - while (length2 >= 2 && data2[length2-2] == 0xff && - (data2[length2-1] == 0xd9 || data2[length2-1] == 0xd8)) { - length2 -= 2; - } - } else { - length2 = 0; - } - - tmplength = length1 + length2 + 4; - tmpdata = g_malloc (tmplength); + unsigned char *tmpdata; + int tmplength; - tmpdata[0] = 0xff; - tmpdata[1] = 0xd8; - memcpy (tmpdata + 2, data1, length1); - memcpy (tmpdata + 2 + length1, data2, length2); - tmpdata[2 + length1 + length2] = 0xff; - tmpdata[2 + length1 + length2 + 1] = 0xd9; + tmplen...

...> > + struct stat stbuf; > > + struct pstore_read_arg *rarg = NULL; > > + Error *err = NULL; > > + int ret = -1; > > + > > + if (s->file_idx >= s->num_file) { > > + return 0; > > + } > > + > > + rarg = g_malloc(sizeof(*rarg)); > > + if (rarg == NULL) { > > + return -1; > > + } > > + > > + idx = s->file_idx++; > > + filename = virtio_pstore_from_filename(s, s->files[idx]->d_name, > > + &rarg-...

..._oversample, dec->components[i].h_oversample); @@ -263,13 +267,11 @@ jpeg_decoder_sof_baseline_dct (JpegDecod (dec->height_blocks * 8 * max_v_oversample / dec->components[i].v_subsample); dec->components[i].rowstride = rowstride; - dec->components[i].image = g_malloc (image_size); + dec->components[i].image = malloc (image_size); } -#ifdef JPEG_DEBUG_ON if (bits->end != bits->ptr) - JPEG_WARNING ("endptr != bits"); -#endif + OIL_DEBUG ("endptr != bits"); return length; } @@ -283,7 +285,7 @@ jpeg_decoder_define...

...615,7 +2615,7 @@ _dm_create_part(const LDMPartitionPrivate * const part, uint32_t cookie, static GString * _dm_create_spanned(const LDMVolumePrivate * const vol, GError ** const err) { - static GString *name = NULL; + GString *name = NULL; guint i = 0; struct dm_target *targets = g_malloc(sizeof(*targets) * vol->parts->len); @@ -2682,7 +2682,7 @@ out: static GString * _dm_create_striped(const LDMVolumePrivate * const vol, GError ** const err) { - static GString *name = NULL; + GString *name = NULL; struct dm_target target; target.start = 0; -- 2.17.0

...615,7 +2615,7 @@ _dm_create_part(const LDMPartitionPrivate * const part, uint32_t cookie, static GString * _dm_create_spanned(const LDMVolumePrivate * const vol, GError ** const err) { - static GString *name = NULL; + GString *name = NULL; guint i = 0; struct dm_target *targets = g_malloc(sizeof(*targets) * vol->parts->len); @@ -2682,7 +2682,7 @@ out: static GString * _dm_create_striped(const LDMVolumePrivate * const vol, GError ** const err) { - static GString *name = NULL; + GString *name = NULL; struct dm_target target; target.start = 0; @@ -2961,7 +2...

v1 was here: https://www.redhat.com/archives/libguestfs/2018-May/msg00058.html v2: - more correct explanation of a crash reason. Mykola Ivanets (1): Fix crash while creating mapper for a volume which lacks of partitions. src/ldm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.17.0

...nts was 0, that could happen diff --git a/libswfdec/swfdec_bits.c b/libswfdec/swfdec_bits.c index b74846e..c8a5062 100644 --- a/libswfdec/swfdec_bits.c +++ b/libswfdec/swfdec_bits.c @@ -587,7 +587,7 @@ swfdec_bits_get_gradient (SwfdecBits * b n_gradients = swfdec_bits_get_u8 (bits); grad = g_malloc (sizeof (SwfdecGradient) + - sizeof (SwfdecGradientEntry) * (n_gradients - 1)); + sizeof (SwfdecGradientEntry) * (MAX (n_gradients, 1) - 1)); for (i = 0; i < n_gradients && swfdec_bits_left (bits); i++) { grad->array[i].ratio = swfdec_bits_get_u8 (bits); grad-&g...

...t;width); SWFDEC_LOG (" height = %d", image->height); @@ -464,6 +464,7 @@ swfdec_image_lossless_load (SwfdecImage if (have_alpha) { SWFDEC_INFO("16bit images aren't allowed to have alpha, ignoring"); + have_alpha = FALSE; } image_data = g_malloc (4 * image->width * image->height); @@ -513,7 +514,7 @@ swfdec_image_lossless_load (SwfdecImage } } - swfdec_image_create_surface (image, image_data); + swfdec_image_create_surface (image, image_data, have_alpha); } int @@ -626,3 +627,33 @@ swfdec_image_get_surface (SwfdecIma...

...= lossless (bits.ptr, endptr - bits.ptr, image->width * image->height); - bits.ptr = endptr; if (format == 3) { - unsigned char *color_table; unsigned char *indexed_data; - int i; + guint i; + unsigned int rowstride = (image->width + 3) & ~3; image_data = g_malloc (4 * image->width * image->height); image->rowstride = image->width * 4; - color_table = g_malloc (color_table_size * 4); - if (have_alpha) { + ptr = lossless (bits.ptr, bits.end - bits.ptr, + color_table_size * 4 + rowstride * image->height); for (i = 0...

...endptr; SwfdecBits bits; - unsigned char *image_data = NULL; int have_alpha = (image->type == SWFDEC_IMAGE_TYPE_LOSSLESS2); bits.buffer = image->raw_data; @@ -414,7 +391,7 @@ swfdec_image_lossless_load (SwfdecImage unsigned char *indexed_data; int i; - image_data = g_malloc (4 * image->width * image->height); + image->data = g_malloc (4 * image->width * image->height); image->rowstride = image->width * 4; color_table = g_malloc (color_table_size * 4); @@ -450,7 +427,7 @@ swfdec_image_lossless_load (SwfdecImage } index...