averello/ImageMagick-mirror
1
0
Fork 0
mirror of https://github.com/ImageMagick/ImageMagick.git synced 2026-05-31 11:18:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix unsound free of uninitialized pointers in GetImageFeatures error path (#8724)

Browse Source 
The first error branch in GetImageFeatures freed Q[i] and cooccurrence[i]
before those array elements had been initialized (they are populated by
the subsequent for loop). Remove the inner free loops. The outer Q and
cooccurrence arrays are still released; the second error branch already
handles partially-initialized arrays correctly and is unchanged.
This commit is contained in:
007bsd
2026-05-11 03:23:05 +03:00
committed by GitHub
parent 703f6f5a73
commit c0ecd189ef
1 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MagickCore/feature.c
+3 -12
View File
@@ -790,11 +790,7 @@ MagickExport ChannelFeatures *GetImageFeatures(const Image *image,
(sum == (ChannelStatistics *) NULL))
{
if (Q != (ChannelStatistics **) NULL)
{
for (i=0; i < (ssize_t) number_grays; i++)
Q[i]=(ChannelStatistics *) RelinquishMagickMemory(Q[i]);
Q=(ChannelStatistics **) RelinquishMagickMemory(Q);
}
Q=(ChannelStatistics **) RelinquishMagickMemory(Q);
if (sum != (ChannelStatistics *) NULL)
sum=(ChannelStatistics *) RelinquishMagickMemory(sum);
if (density_y != (ChannelStatistics *) NULL)
@@ -804,13 +800,8 @@ MagickExport ChannelFeatures *GetImageFeatures(const Image *image,
if (density_x != (ChannelStatistics *) NULL)
density_x=(ChannelStatistics *) RelinquishMagickMemory(density_x);
if (cooccurrence != (ChannelStatistics **) NULL)
{
for (i=0; i < (ssize_t) number_grays; i++)
cooccurrence[i]=(ChannelStatistics *)
RelinquishMagickMemory(cooccurrence[i]);
cooccurrence=(ChannelStatistics **) RelinquishMagickMemory(
cooccurrence);
}
cooccurrence=(ChannelStatistics **) RelinquishMagickMemory(
cooccurrence);
grays=(PixelPacket *) RelinquishMagickMemory(grays);
channel_features=(ChannelFeatures *) RelinquishMagickMemory(
channel_features);