libgd
/
libgd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix several uninitialized variable reads, dereferences before NULL checks, resource leaks and some other minor errors

master
Ondřej Surý 2013-04-08 12:53:52 +02:00
parent c2711be4c9
commit 15ea6bc5a1
11 changed files with 68 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/gd.c
View File

@ -2828,7 +2828,6 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm (FILE * fd)
}
/* Shouldn't happen */
fprintf (stderr, "Error: bug in gdImageCreateFromXbm!\n");
return 0;
fail:
gdImageDestroy (im);
return 0;

11
src/gd_filter.c
View File

@ -210,12 +210,13 @@ BGD_DECLARE(int) gdImageGrayScale(gdImagePtr src)
int r,g,b,a;
int new_pxl, pxl;
FuncPtr f;
f = GET_PIXEL_FUNCTION(src);
if (src==NULL) {
return 0;
}
f = GET_PIXEL_FUNCTION(src);
for (y=0; y<src->sy; ++y) {
for (x=0; x<src->sx; ++x) {
pxl = f (src, x, y);
@ -242,9 +243,8 @@ BGD_DECLARE(int) gdImageBrightness(gdImagePtr src, int brightness)
int r,g,b,a;
int new_pxl, pxl;
FuncPtr f;
f = GET_PIXEL_FUNCTION(src);
if (src==NULL || (brightness < -255 || brightness>255)) {
if (src==NULL || (brightness < -255 || brightness > 255)) {
return 0;
}
@ -252,6 +252,8 @@ BGD_DECLARE(int) gdImageBrightness(gdImagePtr src, int brightness)
return 1;
}
f = GET_PIXEL_FUNCTION(src);
for (y=0; y<src->sy; ++y) {
for (x=0; x<src->sx; ++x) {
pxl = f (src, x, y);
@ -288,12 +290,13 @@ BGD_DECLARE(int) gdImageContrast(gdImagePtr src, double contrast)
int new_pxl, pxl;
FuncPtr f;
f = GET_PIXEL_FUNCTION(src);
if (src==NULL) {
return 0;
}
f = GET_PIXEL_FUNCTION(src);
contrast = (double)(100.0-contrast)/100.0;
contrast = contrast*contrast;

18
src/gd_gd2.c
View File

@ -161,10 +161,10 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
}
for (i = 0; i < nc; i++) {
if (gdGetInt (&cidx[i].offset, in) != 1) {
goto fail1;
goto fail2;
};
if (gdGetInt (&cidx[i].size, in) != 1) {
goto fail1;
goto fail2;
};
};
*chunkIdx = cidx;
@ -173,7 +173,8 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
GD2_DBG (printf ("gd2 header complete\n"));
return 1;
fail2:
gdFree(cidx);
fail1:
return 0;
}
@ -196,21 +197,21 @@ _gd2CreateFromFile (gdIOCtxPtr in, int *sx, int *sy,
}
if (im == NULL) {
GD2_DBG (printf ("Could not create gdImage\n"));
goto fail1;
goto fail2;
};
if (!_gdGetColors (in, im, (*vers) == 2)) {
GD2_DBG (printf ("Could not read color palette\n"));
goto fail2;
goto fail3;
}
GD2_DBG (printf ("Image palette completed: %d colours\n", im->colorsTotal));
return im;
fail2:
fail3:
gdImageDestroy (im);
return 0;
fail2:
gdFree(*cidx);
fail1:
return 0;
@ -297,6 +298,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
&chunkIdx);
if (im == NULL) {
gdFree (chunkIdx);
return 0;
}

4
src/gd_gif_out.c
View File

@ -255,7 +255,7 @@ static int comparewithmap(gdImagePtr im1, gdImagePtr im2, int c1, int c2, int *c
BGD_DECLARE(void) gdImageGifAnimAddCtx(gdImagePtr im, gdIOCtxPtr out, int LocalCM, int LeftOfs, int TopOfs, int Delay, int Disposal, gdImagePtr previm)
{
gdImagePtr pim = 0, tim = im;
gdImagePtr pim = NULL, tim = im;
int interlace, transparent, BitsPerPixel;
interlace = im->interlace;
transparent = im->transparent;
@ -301,7 +301,7 @@ BGD_DECLARE(void) gdImageGifAnimAddCtx(gdImagePtr im, gdIOCtxPtr out, int LocalC
if (previm->trueColor) {
prev_pim = gdImageCreatePaletteFromTrueColor(previm, 1, 256);
if (!prev_pim) {
return;
goto fail_end;
}
prev_tim = prev_pim;
}

62
src/gd_interpolation.c
View File

@ -652,7 +652,7 @@ static inline int getPixelOverflowTC(gdImagePtr im, const int x, const int y, co
}
return c;
} else {
register int border;
register int border = 0;
if (y < im->cy1) {
border = im->tpixels[0][im->cx1];
@ -703,7 +703,7 @@ static inline int getPixelOverflowPalette(gdImagePtr im, const int x, const int
}
return colorIndex2RGBA(c);
} else {
register int border;
register int border = 0;
if (y < im->cy1) {
border = gdImageGetPixel(im, im->cx1, 0);
goto processborder;
@ -895,7 +895,7 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
return res;
}
static inline _gdContributionsFree(LineContribType * p)
static inline void _gdContributionsFree(LineContribType * p)
{
unsigned int u;
for (u = 0; u < p->LineLength; u++) {
@ -1010,41 +1010,41 @@ static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsign
_gdContributionsFree (contrib);
}
static inline _gdScaleCol (gdImagePtr pSrc, unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib)
static inline void _gdScaleCol (gdImagePtr pSrc, unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib)
{
unsigned int y;
for (y = 0; y < dst_height - 1; y++) {
register unsigned char r = 0, g = 0, b = 0, a = 0;
const int iLeft = contrib->ContribRow[y].Left;
const int iRight = contrib->ContribRow[y].Right;
for (y = 0; y < dst_height - 1; y++) {
register unsigned char r = 0, g = 0, b = 0, a = 0;
const int iLeft = contrib->ContribRow[y].Left;
const int iRight = contrib->ContribRow[y].Right;
int i;
int *row = pRes->tpixels[y];
/* Accumulate each channel */
for (i = iLeft; i <= iRight; i++) {
const int pCurSrc = pSrc->tpixels[i][uCol];
for (i = iLeft; i <= iRight; i++) {
const int pCurSrc = pSrc->tpixels[i][uCol];
const int i_iLeft = i - iLeft;
r += (unsigned char)(contrib->ContribRow[y].Weights[i_iLeft] * (double)(gdTrueColorGetRed(pCurSrc)));
g += (unsigned char)(contrib->ContribRow[y].Weights[i_iLeft] * (double)(gdTrueColorGetGreen(pCurSrc)));
b += (unsigned char)(contrib->ContribRow[y].Weights[i_iLeft] * (double)(gdTrueColorGetBlue(pCurSrc)));
r += (unsigned char)(contrib->ContribRow[y].Weights[i_iLeft] * (double)(gdTrueColorGetRed(pCurSrc)));
g += (unsigned char)(contrib->ContribRow[y].Weights[i_iLeft] * (double)(gdTrueColorGetGreen(pCurSrc)));
b += (unsigned char)(contrib->ContribRow[y].Weights[i_iLeft] * (double)(gdTrueColorGetBlue(pCurSrc)));
a += (unsigned char)(contrib->ContribRow[y].Weights[i_iLeft] * (double)(gdTrueColorGetAlpha(pCurSrc)));
}
}
pRes->tpixels[y][uCol] = gdTrueColorAlpha(r, g, b, a);
}
}
}
static inline _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
{
unsigned int u;
LineContribType * contrib;
/* same height, copy it */
if (src_height == dst_height) {
if (src_height == dst_height) {
unsigned int y;
for (y = 0; y < src_height - 1; ++y) {
memcpy(pDst->tpixels[y], pSrc->tpixels[y], src_width);
}
}
}
contrib = _gdContributionsCalc(dst_height, src_height, (double)(dst_height) / (double)(src_height), pSrc->interpolation);
/* scale each column */
@ -1056,40 +1056,40 @@ static inline _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width,
gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const unsigned int new_width, const unsigned int new_height)
{
gdImagePtr tmp_im;
gdImagePtr tmp_im;
gdImagePtr dst;
tmp_im = gdImageCreateTrueColor(new_width, src_height);
if (tmp_im == NULL) {
return NULL;
}
_gdScaleHoriz (src, src_width, src_height, tmp_im, new_width, src_height);
_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
dst = gdImageCreateTrueColor(new_width, new_height);
if (dst == NULL) {
gdFree(tmp_im);
return NULL;
}
_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
gdFree(tmp_im);
return dst;
return dst;
}
gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const gdImagePtr dst, const unsigned int new_width, const unsigned int new_height)
{
gdImagePtr tmp_im;
gdImagePtr tmp_im;
tmp_im = gdImageCreateTrueColor(new_width, src_height);
if (tmp_im == NULL) {
return NULL;
}
_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
gdFree(tmp_im);
return dst;
return dst;
}
/*
@ -1158,7 +1158,7 @@ static inline int getPixelOverflowColorTC(gdImagePtr im, const int x, const int
}
return c;
} else {
register int border;
register int border = 0;
if (y < im->cy1) {
border = im->tpixels[0][im->cx1];
goto processborder;
@ -2342,12 +2342,12 @@ BGD_DECLARE(int) gdTransformAffineCopy(gdImagePtr dst,
gdPointF pt, src_pt;
gdRect bbox;
int end_x, end_y;
gdInterpolationMethod interpolotion_id_bak;
gdInterpolationMethod interpolation_id_bak = GD_DEFAULT;
interpolation_method interpolation_bak;
/* These methods use special implementations */
if (src->interpolation_id == GD_BILINEAR_FIXED || src->interpolation_id == GD_BICUBIC_FIXED || src->interpolation_id == GD_NEAREST_NEIGHBOUR) {
interpolotion_id_bak = src->interpolation_id;
interpolation_id_bak = src->interpolation_id;
interpolation_bak = src->interpolation;
gdImageSetInterpolationMethod(src, GD_BICUBIC);
@ -2374,7 +2374,7 @@ BGD_DECLARE(int) gdTransformAffineCopy(gdImagePtr dst,
gdImageSetClip(src, backup_clipx1, backup_clipy1,
backup_clipx2, backup_clipy2);
}
gdImageSetInterpolationMethod(src, interpolotion_id_bak);
gdImageSetInterpolationMethod(src, interpolation_id_bak);
return GD_FALSE;
}
@ -2424,7 +2424,7 @@ BGD_DECLARE(int) gdTransformAffineCopy(gdImagePtr dst,
backup_clipx2, backup_clipy2);
}
gdImageSetInterpolationMethod(src, interpolotion_id_bak);
gdImageSetInterpolationMethod(src, interpolation_id_bak);
return GD_TRUE;
}

2
src/gd_nnquant.c
View File

@ -516,7 +516,7 @@ BGD_DECLARE(gdImagePtr) gdImageNeuQuant(gdImagePtr im, const int max_color, int
int row;
unsigned char *rgba = NULL;
gdImagePtr dst;
gdImagePtr dst = NULL;
/* Default it to 3 */
if (sample_factor < 1) {

10
src/gd_rotate.c
View File

@ -224,12 +224,12 @@ gdImagePtr gdImageRotate90 (gdImagePtr src, int ignoretransparent)
f = gdImageGetPixel;
}
dst = gdImageCreateTrueColor(src->sy, src->sx);
dst->transparent = src->transparent;
if (dst != NULL) {
int old_blendmode = dst->alphaBlendingFlag;
dst->alphaBlendingFlag = 0;
dst->transparent = src->transparent;
gdImagePaletteCopy (dst, src);
for (uY = 0; uY<src->sy; uY++) {
@ -269,12 +269,13 @@ gdImagePtr gdImageRotate180 (gdImagePtr src, int ignoretransparent)
f = gdImageGetPixel;
}
dst = gdImageCreateTrueColor(src->sx, src->sy);
dst->transparent = src->transparent;
if (dst != NULL) {
int old_blendmode = dst->alphaBlendingFlag;
dst->alphaBlendingFlag = 0;
dst->transparent = src->transparent;
gdImagePaletteCopy (dst, src);
for (uY = 0; uY<src->sy; uY++) {
@ -315,12 +316,13 @@ gdImagePtr gdImageRotate270 (gdImagePtr src, int ignoretransparent)
f = gdImageGetPixel;
}
dst = gdImageCreateTrueColor (src->sy, src->sx);
dst->transparent = src->transparent;
if (dst != NULL) {
int old_blendmode = dst->alphaBlendingFlag;
dst->alphaBlendingFlag = 0;
dst->transparent = src->transparent;
gdImagePaletteCopy (dst, src);
for (uY = 0; uY<src->sy; uY++) {

14
src/gd_topal.c
View File

@ -1506,7 +1506,7 @@ static int gdImageTrueColorToPaletteBody (gdImagePtr oim, int dither, int colors
goto outOfMemory;
}
for (i = 0; (i < nim->sy); i++) {
nim->pixels[i] = gdCalloc (sizeof (unsigned char *), oim->sx);
nim->pixels[i] = (unsigned char *) gdCalloc (sizeof (unsigned char *), oim->sx);
if (!nim->pixels[i]) {
goto outOfMemory;
}
@ -1685,15 +1685,15 @@ outOfMemory:
if (oim->trueColor) {
if (!cimP) {
/* On failure only */
for (i = 0; i < nim->sy; i++) {
if (nim->pixels[i]) {
gdFree (nim->pixels[i]);
}
}
if (nim->pixels) {
for (i = 0; i < nim->sy; i++) {
if (nim->pixels[i]) {
gdFree (nim->pixels[i]);
}
}
gdFree (nim->pixels);
}
nim->pixels = 0;
nim->pixels = NULL;
} else {
gdImageDestroy(nim);
*cimP = 0;

4
src/gdft.c
View File

@ -1485,7 +1485,7 @@ static char * font_path(char **fontpath, char *name_list)
char *fontsearchpath, *fontlist;
char *fullname = NULL;
char *name, *path, *dir;
char *strtok_ptr;
char *strtok_ptr = NULL;
/*
* Search the pathlist for any of a list of font names.
@ -1501,7 +1501,7 @@ static char * font_path(char **fontpath, char *name_list)
*/
for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name;
name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) {
char *path_ptr;
char *path_ptr = NULL;
/* make a fresh copy each time - strtok corrupts it. */
path = strdup (fontsearchpath);

2
src/pngtogd.c
View File

@ -15,7 +15,7 @@
int
main (int argc, char **argv)
{
gdImagePtr im;
gdImagePtr im = NULL;
FILE *in, *out;
if (argc != 3) {
fprintf (stderr, "Usage: pngtogd filename.png filename.gd\n");

1
src/wbmp.c
View File

@ -152,6 +152,7 @@ int readwbmp(int (*getin) (void *in), void *in, Wbmp **return_wbmp)
}
if(skipheader(getin, in)) {
gdFree(wbmp);
return -1;
}