aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPřemysl Eric Janouch <p@janouch.name>2022-01-21 19:01:00 +0100
committerPřemysl Eric Janouch <p@janouch.name>2022-01-21 19:03:05 +0100
commit686d45553b861f8b42707049adf366a14abea4ab (patch)
tree53041fecde41f1753abd0cc9935f3699a7540205
parent4ba1d85363a3b32d24b487cec68555853a3c6735 (diff)
downloadfiv-686d45553b861f8b42707049adf366a14abea4ab.tar.gz
fiv-686d45553b861f8b42707049adf366a14abea4ab.tar.xz
fiv-686d45553b861f8b42707049adf366a14abea4ab.zip
Plug a corner-case memory leak, fix range checks
-rw-r--r--fiv-io.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fiv-io.c b/fiv-io.c
index ef5c26e..4189917 100644
--- a/fiv-io.c
+++ b/fiv-io.c
@@ -1368,7 +1368,7 @@ open_resvg(const gchar *data, gsize len, const gchar *uri, GError **error)
// TODO(p): Support retrieving a scaled-up/down version.
// TODO(p): See if there is a situation for resvg_get_image_viewbox().
resvg_size size = resvg_get_image_size(tree);
- int w = ceil(size.width), h = ceil(size.height);
+ double w = ceil(size.width), h = ceil(size.height);
if (w > SHRT_MAX || h > SHRT_MAX) {
set_error(error, "image dimensions overflow");
resvg_tree_destroy(tree);
@@ -1381,6 +1381,7 @@ open_resvg(const gchar *data, gsize len, const gchar *uri, GError **error)
if (surface_status != CAIRO_STATUS_SUCCESS) {
set_error(error, cairo_status_to_string(surface_status));
cairo_surface_destroy(surface);
+ resvg_tree_destroy(tree);
return NULL;
}