259 lines
8.2 KiB
Diff
259 lines
8.2 KiB
Diff
From 6adac809e96c8bfeb50a3bd14570a8118bcd5d65 Mon Sep 17 00:00:00 2001
|
|
From: Lumir Balhar <lbalhar@redhat.com>
|
|
Date: Thu, 13 Sep 2018 12:22:11 +0200
|
|
Subject: [PATCH 2/2] Fix potential leaked storage issues (CWE-772)
|
|
|
|
---
|
|
src/Tk/tkImaging.c | 2 ++
|
|
src/_imaging.c | 15 +++++++++++++--
|
|
src/encode.c | 12 +++++++++---
|
|
src/libImaging/Histo.c | 12 +++++++++---
|
|
src/libImaging/Quant.c | 2 ++
|
|
src/libImaging/QuantOctree.c | 1 +
|
|
src/libImaging/Resample.c | 2 ++
|
|
src/path.c | 8 ++++++--
|
|
8 files changed, 44 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/src/Tk/tkImaging.c b/src/Tk/tkImaging.c
|
|
index f448be16..10090b0e 100644
|
|
--- a/src/Tk/tkImaging.c
|
|
+++ b/src/Tk/tkImaging.c
|
|
@@ -442,6 +442,7 @@ int load_tkinter_funcs(void)
|
|
/* Try loading from the main program namespace first */
|
|
main_program = dlopen(NULL, RTLD_LAZY);
|
|
if (_func_loader(main_program) == 0) {
|
|
+ dlclose(main_program);
|
|
return 0;
|
|
}
|
|
/* Clear exception triggered when we didn't find symbols above */
|
|
@@ -470,6 +471,7 @@ int load_tkinter_funcs(void)
|
|
/* dlclose probably safe because tkinter has been imported. */
|
|
dlclose(tkinter_lib);
|
|
exit:
|
|
+ dlclose(main_program);
|
|
Py_XDECREF(pModule);
|
|
Py_XDECREF(pString);
|
|
return ret;
|
|
diff --git a/src/_imaging.c b/src/_imaging.c
|
|
index 11f5f6ea..445470bf 100644
|
|
--- a/src/_imaging.c
|
|
+++ b/src/_imaging.c
|
|
@@ -856,8 +856,10 @@ _gaussian_blur(ImagingObject* self, PyObject* args)
|
|
if (!imOut)
|
|
return NULL;
|
|
|
|
- if (!ImagingGaussianBlur(imOut, imIn, radius, passes))
|
|
+ if (!ImagingGaussianBlur(imOut, imIn, radius, passes)) {
|
|
+ ImagingDelete(imOut);
|
|
return NULL;
|
|
+ }
|
|
|
|
return PyImagingNew(imOut);
|
|
}
|
|
@@ -1745,8 +1747,10 @@ _box_blur(ImagingObject* self, PyObject* args)
|
|
if (!imOut)
|
|
return NULL;
|
|
|
|
- if (!ImagingBoxBlur(imOut, imIn, radius, n))
|
|
+ if (!ImagingBoxBlur(imOut, imIn, radius, n)) {
|
|
+ ImagingDelete(imOut);
|
|
return NULL;
|
|
+ }
|
|
|
|
return PyImagingNew(imOut);
|
|
}
|
|
@@ -2386,6 +2390,7 @@ _draw_arc(ImagingDrawObject* self, PyObject* args)
|
|
return NULL;
|
|
if (n != 2) {
|
|
PyErr_SetString(PyExc_TypeError, must_be_two_coordinates);
|
|
+ free(xy);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -2423,6 +2428,7 @@ _draw_bitmap(ImagingDrawObject* self, PyObject* args)
|
|
PyErr_SetString(PyExc_TypeError,
|
|
"coordinate list must contain exactly 1 coordinate"
|
|
);
|
|
+ free(xy);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -2458,6 +2464,7 @@ _draw_chord(ImagingDrawObject* self, PyObject* args)
|
|
return NULL;
|
|
if (n != 2) {
|
|
PyErr_SetString(PyExc_TypeError, must_be_two_coordinates);
|
|
+ free(xy);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -2493,6 +2500,7 @@ _draw_ellipse(ImagingDrawObject* self, PyObject* args)
|
|
return NULL;
|
|
if (n != 2) {
|
|
PyErr_SetString(PyExc_TypeError, must_be_two_coordinates);
|
|
+ free(xy);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -2674,6 +2682,7 @@ _draw_pieslice(ImagingDrawObject* self, PyObject* args)
|
|
return NULL;
|
|
if (n != 2) {
|
|
PyErr_SetString(PyExc_TypeError, must_be_two_coordinates);
|
|
+ free(xy);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -2712,6 +2721,7 @@ _draw_polygon(ImagingDrawObject* self, PyObject* args)
|
|
PyErr_SetString(PyExc_TypeError,
|
|
"coordinate list must contain at least 2 coordinates"
|
|
);
|
|
+ free(xy);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -2754,6 +2764,7 @@ _draw_rectangle(ImagingDrawObject* self, PyObject* args)
|
|
return NULL;
|
|
if (n != 2) {
|
|
PyErr_SetString(PyExc_TypeError, must_be_two_coordinates);
|
|
+ free(xy);
|
|
return NULL;
|
|
}
|
|
|
|
diff --git a/src/encode.c b/src/encode.c
|
|
index ae4277c0..9f7c6592 100644
|
|
--- a/src/encode.c
|
|
+++ b/src/encode.c
|
|
@@ -552,11 +552,15 @@ PyImaging_ZipEncoderNew(PyObject* self, PyObject* args)
|
|
dictionary = NULL;
|
|
|
|
encoder = PyImaging_EncoderNew(sizeof(ZIPSTATE));
|
|
- if (encoder == NULL)
|
|
+ if (encoder == NULL) {
|
|
+ free(dictionary);
|
|
return NULL;
|
|
+ }
|
|
|
|
- if (get_packer(encoder, mode, rawmode) < 0)
|
|
+ if (get_packer(encoder, mode, rawmode) < 0) {
|
|
+ free(dictionary);
|
|
return NULL;
|
|
+ }
|
|
|
|
encoder->encode = ImagingZipEncode;
|
|
encoder->cleanup = ImagingZipEncodeCleanup;
|
|
@@ -717,8 +721,10 @@ PyImaging_JpegEncoderNew(PyObject* self, PyObject* args)
|
|
if (rawExif && rawExifLen > 0) {
|
|
/* malloc check ok, length is from python parsearg */
|
|
char* pp = malloc(rawExifLen); // Freed in JpegEncode, Case 5
|
|
- if (!pp)
|
|
+ if (!pp) {
|
|
+ if (extra) free(extra);
|
|
return PyErr_NoMemory();
|
|
+ }
|
|
memcpy(pp, rawExif, rawExifLen);
|
|
rawExif = pp;
|
|
} else
|
|
diff --git a/src/libImaging/Histo.c b/src/libImaging/Histo.c
|
|
index 2b35873e..b7c1a983 100644
|
|
--- a/src/libImaging/Histo.c
|
|
+++ b/src/libImaging/Histo.c
|
|
@@ -82,8 +82,10 @@ ImagingGetHistogram(Imaging im, Imaging imMask, void* minmax)
|
|
h->histogram[im->image8[y][x]]++;
|
|
ImagingSectionLeave(&cookie);
|
|
} else { /* yes, we need the braces. C isn't Python! */
|
|
- if (im->type != IMAGING_TYPE_UINT8)
|
|
+ if (im->type != IMAGING_TYPE_UINT8) {
|
|
+ ImagingHistogramDelete(h);
|
|
return ImagingError_ModeError();
|
|
+ }
|
|
ImagingSectionEnter(&cookie);
|
|
for (y = 0; y < im->ysize; y++) {
|
|
UINT8* in = (UINT8*) im->image32[y];
|
|
@@ -122,8 +124,10 @@ ImagingGetHistogram(Imaging im, Imaging imMask, void* minmax)
|
|
ImagingSectionLeave(&cookie);
|
|
break;
|
|
case IMAGING_TYPE_INT32:
|
|
- if (!minmax)
|
|
+ if (!minmax) {
|
|
+ ImagingHistogramDelete(h);
|
|
return ImagingError_ValueError("min/max not given");
|
|
+ }
|
|
if (!im->xsize || !im->ysize)
|
|
break;
|
|
imin = ((INT32*) minmax)[0];
|
|
@@ -143,8 +147,10 @@ ImagingGetHistogram(Imaging im, Imaging imMask, void* minmax)
|
|
ImagingSectionLeave(&cookie);
|
|
break;
|
|
case IMAGING_TYPE_FLOAT32:
|
|
- if (!minmax)
|
|
+ if (!minmax) {
|
|
+ ImagingHistogramDelete(h);
|
|
return ImagingError_ValueError("min/max not given");
|
|
+ }
|
|
if (!im->xsize || !im->ysize)
|
|
break;
|
|
fmin = ((FLOAT32*) minmax)[0];
|
|
diff --git a/src/libImaging/Quant.c b/src/libImaging/Quant.c
|
|
index df313816..b94dc6e1 100644
|
|
--- a/src/libImaging/Quant.c
|
|
+++ b/src/libImaging/Quant.c
|
|
@@ -568,6 +568,8 @@ split(BoxNode *node)
|
|
left=malloc(sizeof(BoxNode));
|
|
right=malloc(sizeof(BoxNode));
|
|
if (!left||!right) {
|
|
+ free(left);
|
|
+ free(right);
|
|
return 0;
|
|
}
|
|
for(i=0;i<3;i++) {
|
|
diff --git a/src/libImaging/QuantOctree.c b/src/libImaging/QuantOctree.c
|
|
index e18ab3c6..d778c942 100644
|
|
--- a/src/libImaging/QuantOctree.c
|
|
+++ b/src/libImaging/QuantOctree.c
|
|
@@ -470,6 +470,7 @@ error:
|
|
free(qp);
|
|
free_color_cube(lookupCube);
|
|
free_color_cube(coarseLookupCube);
|
|
+ free(paletteBuckets);
|
|
free(paletteBucketsCoarse);
|
|
free(paletteBucketsFine);
|
|
free_color_cube(coarseCube);
|
|
diff --git a/src/libImaging/Resample.c b/src/libImaging/Resample.c
|
|
index cda005d9..b90395e8 100644
|
|
--- a/src/libImaging/Resample.c
|
|
+++ b/src/libImaging/Resample.c
|
|
@@ -538,6 +538,8 @@ ImagingResampleInner(Imaging imIn, int xsize, int ysize,
|
|
if ( ! ksize_vert) {
|
|
free(bounds_horiz);
|
|
free(kk_horiz);
|
|
+ free(bounds_vert);
|
|
+ free(kk_vert);
|
|
return NULL;
|
|
}
|
|
|
|
diff --git a/src/path.c b/src/path.c
|
|
index b56ea838..5984a3d1 100644
|
|
--- a/src/path.c
|
|
+++ b/src/path.c
|
|
@@ -82,12 +82,16 @@ path_new(Py_ssize_t count, double* xy, int duplicate)
|
|
xy = p;
|
|
}
|
|
|
|
- if (PyType_Ready(&PyPathType) < 0)
|
|
+ if (PyType_Ready(&PyPathType) < 0) {
|
|
+ free(xy);
|
|
return NULL;
|
|
+ }
|
|
|
|
path = PyObject_New(PyPathObject, &PyPathType);
|
|
- if (path == NULL)
|
|
+ if (path == NULL) {
|
|
+ free(xy);
|
|
return NULL;
|
|
+ }
|
|
|
|
path->count = count;
|
|
path->xy = xy;
|
|
--
|
|
2.17.1
|
|
|