Skip to content

Commit 19ffddb

Browse files
committed
prevent double-free() on broken full-color images error handling
1 parent 2f912f5 commit 19ffddb

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

Diff for: src/libraw_cxx.cpp

+8-2
Original file line numberDiff line numberDiff line change
@@ -1144,8 +1144,8 @@ int LibRaw::unpack(void)
11441144
IO.shrink = 0;
11451145
S.raw_pitch = S.width*8;
11461146
// allocate image as temporary buffer, size
1147-
imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
1148-
imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
1147+
imgdata.rawdata.raw_alloc = 0;
1148+
imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
11491149
}
11501150
ID.input->seek(libraw_internal_data.unpacker_data.data_offset, SEEK_SET);
11511151

@@ -1155,6 +1155,12 @@ int LibRaw::unpack(void)
11551155
(this->*load_raw)();
11561156
if(load_raw == &LibRaw::unpacked_load_raw && !strcasecmp(imgdata.idata.make,"Nikon"))
11571157
C.maximum = m_save;
1158+
if (decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY)
1159+
{
1160+
// successfully decoded legacy image, attach image to raw_alloc
1161+
imgdata.rawdata.raw_alloc = imgdata.image;
1162+
imgdata.image = 0;
1163+
}
11581164
}
11591165

11601166
if(imgdata.rawdata.raw_image)

0 commit comments

Comments
 (0)