commit 5756a77fa289ce1ef18bd7f2da75a39575ead9fe
author kcwu <kcwu@chromium.org> Mon Nov 07 08:42:15 2016 -0800
committer Commit bot <commit-bot@chromium.org> Mon Nov 07 08:42:15 2016 -0800
tree 55fc6c4f7fe9bbe4d7a5dd1bfc4e8797c67b0c0c
parent 014b012278b7438ef8d4b66730b8598c7eb4623a

lcms: Fix memory leak in ReadSegmentedCurve

BUG=chromium:658223

Review-Url: https://codereview.chromium.org/2480013002

third_party/lcms2-2.6/0011-memory-leak-ReadSegmentedCurve.patch

diff --git a/third_party/lcms2-2.6/0011-memory-leak-ReadSegmentedCurve.patch b/third_party/lcms2-2.6/0011-memory-leak-ReadSegmentedCurve.patch
new file mode 100644
index 0000000..a6cfe02
--- /dev/null
+++ b/third_party/lcms2-2.6/0011-memory-leak-ReadSegmentedCurve.patch
@@ -0,0 +1,36 @@
+diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
+index 15199c7..04dd0c4 100644
+--- a/third_party/lcms2-2.6/src/cmstypes.c
++++ b/third_party/lcms2-2.6/src/cmstypes.c
+@@ -3968,7 +3968,7 @@ cmsToneCurve* ReadSegmentedCurve(struct _cms_typehandler_struct* self, cmsIOHAND
+             case cmsSigSampledCurveSeg: {
+                 cmsUInt32Number Count;
+ 
+-                if (!_cmsReadUInt32Number(io, &Count)) return NULL;
++                if (!_cmsReadUInt32Number(io, &Count)) goto Error;
+ 
+                 Segments[i].nGridPoints = Count;
+                 Segments[i].SampledPoints = (cmsFloat32Number*) _cmsCalloc(self ->ContextID, Count, sizeof(cmsFloat32Number));
+@@ -3987,7 +3987,7 @@ cmsToneCurve* ReadSegmentedCurve(struct _cms_typehandler_struct* self, cmsIOHAND
+                 _cmsTagSignature2String(String, (cmsTagSignature) ElementSig);
+                 cmsSignalError(self->ContextID, cmsERROR_UNKNOWN_EXTENSION, "Unknown curve element type '%s' found.", String);
+                 }
+-                return NULL;
++                goto Error;
+ 
+          }
+      }
+@@ -4001,7 +4001,12 @@ cmsToneCurve* ReadSegmentedCurve(struct _cms_typehandler_struct* self, cmsIOHAND
+      return Curve;
+ 
+ Error:
+-     if (Segments) _cmsFree(self ->ContextID, Segments);
++     if (Segments) {
++         for (i=0; i < nSegments; i++) {
++             if (Segments[i].SampledPoints) _cmsFree(self ->ContextID, Segments[i].SampledPoints);
++         }
++         _cmsFree(self ->ContextID, Segments);
++     }
+      return NULL;
+ }
+ 

third_party/lcms2-2.6/README.pdfium

diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index 60934f6..b0d5e3e 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -20,4 +20,5 @@
 0008-memory-leak-Type_MPEmatrix_Read.patch: Fix memory leak in MPEmatrix_Read.
 0009-cmsStageAllocMatrix-param-swap.patch: Fix rows/cols swap in cmsStageAllocMatrix.
 0010-reject-nan.patch: Reject NaN when reading float numbers.
+0011-memory-leak-ReadSegmentedCurve.patch: Fix memory leak in ReadSegmentedCurve.
 TODO(ochang): List other patches.

third_party/lcms2-2.6/src/cmstypes.c

diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
index 15199c7..04dd0c4 100644
--- a/third_party/lcms2-2.6/src/cmstypes.c
+++ b/third_party/lcms2-2.6/src/cmstypes.c
@@ -3968,7 +3968,7 @@
             case cmsSigSampledCurveSeg: {
                 cmsUInt32Number Count;
 
-                if (!_cmsReadUInt32Number(io, &Count)) return NULL;
+                if (!_cmsReadUInt32Number(io, &Count)) goto Error;
 
                 Segments[i].nGridPoints = Count;
                 Segments[i].SampledPoints = (cmsFloat32Number*) _cmsCalloc(self ->ContextID, Count, sizeof(cmsFloat32Number));
@@ -3987,7 +3987,7 @@
                 _cmsTagSignature2String(String, (cmsTagSignature) ElementSig);
                 cmsSignalError(self->ContextID, cmsERROR_UNKNOWN_EXTENSION, "Unknown curve element type '%s' found.", String);
                 }
-                return NULL;
+                goto Error;
 
          }
      }
@@ -4001,7 +4001,12 @@
      return Curve;
 
 Error:
-     if (Segments) _cmsFree(self ->ContextID, Segments);
+     if (Segments) {
+         for (i=0; i < nSegments; i++) {
+             if (Segments[i].SampledPoints) _cmsFree(self ->ContextID, Segments[i].SampledPoints);
+         }
+         _cmsFree(self ->ContextID, Segments);
+     }
      return NULL;
 }