- In some cases when an error occurs reading those parts of a JPEG

   file after the image the scan-line buffer could be freed a second
   time.  In cases where the the error occured while reading the image
   data it's possible that the buffer could have leaked.
   Thanks to Gabriel Vasseur for reporting this and help in tracking
   it down.

Changes

@@ -1,5 +1,17 @@
 Imager release history.  Older releases can be found in Changes.old
 
+Imager 0.65 - unreleased
+===========
+
+Bug fixes:
+
+ - In some cases when an error occurs reading those parts of a JPEG
+   file after the image the scan-line buffer could be freed a second
+   time.  In cases where the the error occured while reading the image
+   data it's possible that the buffer could have leaked.
+   Thanks to Gabriel Vasseur for reporting this and help in tracking
+   it down.
+
 Imager 0.64 - 23 April 2008
 ===========
 

jpeg.c

@@ -387,7 +387,7 @@ i_readjpeg_wiol(io_glue *data, int length, char** iptc_itext, int *itlength) {
 #ifdef IMEXIF_ENABLE
   int seen_exif = 0;
 #endif
-  i_color *line_buffer = NULL;
+  i_color * volatile line_buffer = NULL;
   struct jpeg_decompress_struct cinfo;
   struct my_error_mgr jerr;
   JSAMPARRAY buffer;		/* Output row buffer */
@@ -504,6 +504,7 @@ i_readjpeg_wiol(io_glue *data, int length, char** iptc_itext, int *itlength) {
     i_plin(im, 0, cinfo.output_width, cinfo.output_scanline-1, line_buffer);
   }
   myfree(line_buffer);
+  line_buffer = NULL;
 
   /* check for APP1 marker and save */
   markerp = cinfo.marker_list;