snapshot: Don't use extra after it's been freed (CID #220086)

Note this changes the semantics of the value of extra_out such that it
is set to NULL instead of left undefined in case an error is returned.

Coverity ID: 220086
Signed-off-by: Bryce Harrington <bryce@bryceharrington.org>
Reviewed-By: Uli Schlachter <psychon@znc.in>
This commit is contained in:
Bryce Harrington 2018-06-06 11:06:18 -07:00
parent 37655af38d
commit 1c3ecfac13

View file

@ -100,14 +100,17 @@ _cairo_surface_snapshot_acquire_source_image (void *abstract_
cairo_status_t status;
extra = _cairo_malloc (sizeof (*extra));
if (unlikely (extra == NULL))
if (unlikely (extra == NULL)) {
*extra_out = NULL;
return _cairo_error (CAIRO_STATUS_NO_MEMORY);
}
extra->target = _cairo_surface_snapshot_get_target (&surface->base);
status = _cairo_surface_acquire_source_image (extra->target, image_out, &extra->extra);
if (unlikely (status)) {
cairo_surface_destroy (extra->target);
free (extra);
extra = NULL;
}
*extra_out = extra;