Avoid a double free error if reading the colormap fails.

	* io-tga.c (try_colormap, gdk_pixbuf__tga_stop_load): Avoid a
	double free error if reading the colormap fails.

	* io-tiff.c (tiff_image_parse): Make TIFFReadRGBAImage stop on
	errors, since it may otherwise segfault on certain bad TIFFs.

diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c
index 716f56ab5849489ed6eac3877ff3f2e19cdc4525..69c55faa8ffdcaaa58ff6de788360e3e40b8dd21 100644 (file)
--- a/gdk-pixbuf/io-tga.c
+++ b/gdk-pixbuf/io-tga.c
@@ -622,7 +622,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err)
        if (!ctx->cmap->cols) {
                g_set_error(err, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_INSUFFICIENT_MEMORY,
                            _("Can't allocate colormap entries"));
-               g_free(ctx->cmap);
                return FALSE;
        }
 
@@ -645,8 +644,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err)
                        g_set_error(err, GDK_PIXBUF_ERROR, 
                                    GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
                                    _("Unexpected bitdepth for colormap entries"));
-                       g_free(ctx->cmap->cols);
-                       g_free(ctx->cmap);
                        return FALSE;
                }
        }
@@ -874,19 +871,23 @@ static gboolean gdk_pixbuf__tga_stop_load(gpointer data, GError **err)
        TGAContext *ctx = (TGAContext *) data;
        g_return_val_if_fail(ctx != NULL, FALSE);
 
-       g_free(ctx->hdr);
-       if (ctx->cmap)
-               g_free(ctx->cmap);
+       if (ctx->hdr)
+         g_free (ctx->hdr);
+       if (ctx->cmap) {
+         if (ctx->cmap->cols)
+           g_free (ctx->cmap->cols);
+         g_free (ctx->cmap);
+       }
        if (ctx->pbuf)
-               g_object_unref(ctx->pbuf);
+               g_object_unref (ctx->pbuf);
        if (ctx->in->size)
-               ctx->in = io_buffer_free_segment(ctx->in, ctx->in->size, err);
+               ctx->in = io_buffer_free_segment (ctx->in, ctx->in->size, err);
        if (!ctx->in) {
-               g_free(ctx);
+               g_free (ctx);
                return FALSE;
        }
-       io_buffer_free(ctx->in);
-       g_free(ctx);
+       io_buffer_free (ctx->in);
+       g_free (ctx);
        return TRUE;
 }
 

diff --git a/gdk-pixbuf/io-tiff.c b/gdk-pixbuf/io-tiff.c
index d0de1063765740597401abc68ad680204ba0cd3a..ff4a3dab15ab3613c347f529795a3c493b5c03b6 100644 (file)
--- a/gdk-pixbuf/io-tiff.c
+++ b/gdk-pixbuf/io-tiff.c
@@ -195,7 +195,7 @@ tiff_image_parse (TIFF *tiff, TiffContext *context, GError **error)
                 return NULL;
        }
         
-       if (!TIFFReadRGBAImage (tiff, w, h, rast, 0) || global_error) {
+       if (!TIFFReadRGBAImage (tiff, w, h, rast, 1) || global_error) {
                 tiff_set_error (error,
                                 GDK_PIXBUF_ERROR_FAILED,
                                 _("Failed to load RGB data from TIFF file"));