diff options
| author |  David G. Andersen <dga@google.com> | 2016-05-22 15:21:43 -0800 |
|---|---|---|
| committer |  TensorFlower Gardener <gardener@tensorflow.org> | 2016-05-22 16:32:49 -0700 |
| commit | dfe46341cc73c98a111a6610e0d3daa77fe549e9 (patch) | |
| tree | 4cb17ace0228794de0586a46753f660092ba16a2 /tensorflow/core/lib/jpeg | |
| parent | fa41683462316e28ae4c0aa51745525d1d666db4 (diff) | |
Fix corner case memory leak in error path of corrupt CMYK JPEGs.
Leak found by libFuzzer.
Change: 122953669
Diffstat (limited to 'tensorflow/core/lib/jpeg')
| -rw-r--r-- | tensorflow/core/lib/jpeg/jpeg_mem.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/tensorflow/core/lib/jpeg/jpeg_mem.cc b/tensorflow/core/lib/jpeg/jpeg_mem.cc index 2ea5e04055..99386d956d 100644 --- a/tensorflow/core/lib/jpeg/jpeg_mem.cc +++ b/tensorflow/core/lib/jpeg/jpeg_mem.cc @@ -103,6 +103,7 @@ uint8* UncompressLow(const void* srcdata, FewerArgsForCompiler* argball) { cinfo.client_data = &jpeg_jmpbuf; jerr.error_exit = CatchError; if (setjmp(jpeg_jmpbuf)) { + delete[] tempdata; return nullptr; } @@ -148,6 +149,7 @@ uint8* UncompressLow(const void* srcdata, FewerArgsForCompiler* argball) { if (cinfo.output_width <= 0 || cinfo.output_height <= 0) { LOG(ERROR) << "Invalid image size: " << cinfo.output_width << " x " << cinfo.output_height; + jpeg_destroy_decompress(&cinfo); return nullptr; } if (total_size >= (1LL << 29)) { @@ -243,6 +245,7 @@ uint8* UncompressLow(const void* srcdata, FewerArgsForCompiler* argball) { output_line += stride; } delete[] tempdata; + tempdata = NULL; // Convert the RGB data to RGBA, with alpha set to 0xFF to indicate // opacity. |