summaryrefslogtreecommitdiff
path: root/image/png.c
diff options
context:
space:
mode:
authorVincent Sanders <vince@kyllikki.org>2015-05-12 08:32:32 +0100
committerVincent Sanders <vince@kyllikki.org>2015-05-12 08:32:32 +0100
commitd038af317888dc6c14381230eb2927b4231ff52c (patch)
tree1289956f2d3dbc0d350644157d5b36ff70c3f6b8 /image/png.c
parent37aad9c749892219a303734581fae887ee074d22 (diff)
downloadnetsurf-d038af317888dc6c14381230eb2927b4231ff52c.tar.gz
netsurf-d038af317888dc6c14381230eb2927b4231ff52c.tar.bz2
Fix the PNG handler crashing in low memory situations.
Obtaining a netsurf bitmap buffer may fail on some frontends (RISC OS especially) as the bitmap allocation is not performed until the buffer is requested. The PNG image handler failed to check for this when populating the row pointer structure.
Diffstat (limited to 'image/png.c')
-rw-r--r--image/png.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/image/png.c b/image/png.c
index de2059f5a..ecb7e3c65 100644
--- a/image/png.c
+++ b/image/png.c
@@ -404,6 +404,13 @@ static png_bytep *calc_row_pointers(struct bitmap *bitmap)
png_bytep *row_ptrs;
int hloop;
+ /* The buffer allocation may occour when the buffer is aquired
+ * and therefore may fail.
+ */
+ if (buffer == NULL) {
+ return NULL;
+ }
+
row_ptrs = malloc(sizeof(png_bytep) * height);
if (row_ptrs != NULL) {
@@ -485,6 +492,9 @@ png_cache_convert(struct content *c)
if (row_pointers != NULL) {
png_read_image(png_ptr, (png_bytep *) row_pointers);
+ } else {
+ guit->bitmap->destroy((struct bitmap *)bitmap);
+ bitmap = NULL;
}
png_cache_convert_error:
@@ -492,7 +502,9 @@ png_cache_convert_error:
/* cleanup png read */
png_destroy_read_struct(&png_ptr, &info_ptr, &end_info_ptr);
- free((png_bytep *) row_pointers);
+ if (row_pointers != NULL) {
+ free((png_bytep *) row_pointers);
+ }
if (bitmap != NULL) {
guit->bitmap->modified((struct bitmap *)bitmap);