You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
25 lines
751 B
25 lines
751 B
8 years ago
|
|
||
|
|
# HG changeset patch
|
||
|
|
# User Glenn Randers-Pehrson <glennrp+bmo@gmail.com>
|
||
|
|
# Date 1499704855 14400
|
||
|
|
# Node ID d0a76868ca37ae482eb3e8cecbb9150c5348ffe8
|
||
|
|
# Parent b24f2a9b0dd70506d429e537ff3e81532b5bfc23
|
||
|
|
coders/png.c (ReadMNGImage): Fix out-of-order CloseBlob()
|
||
|
|
|
||
|
|
and DestroyImageList() that caused a use-after-free crash.
|
||
|
|
|
||
|
|
diff -r b24f2a9b0dd7 -r d0a76868ca37 coders/png.c
|
||
|
|
--- a/coders/png.c Mon Jul 10 11:31:05 2017 -0400
|
||
|
|
+++ b/coders/png.c Mon Jul 10 12:40:55 2017 -0400
|
||
|
|
@@ -5161,8 +5161,8 @@
|
||
|
|
|
||
|
|
if (image == (Image *) NULL)
|
||
|
|
{
|
||
|
|
+ CloseBlob(previous);
|
||
|
|
DestroyImageList(previous);
|
||
|
|
- CloseBlob(previous);
|
||
|
|
MngInfoFreeStruct(mng_info,&have_mng_structure);
|
||
|
|
return((Image *) NULL);
|
||
|
|
}
|
||
|
|
|