fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2026-05-09 03:48:03 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

_cairo_pdf_surface_finish: Fix leak in error conditions

Browse source 
Make sure surface->object_stream.stream is cleaned up even if things
failed

In poppler oss-fuzz tests we are getting this leak reported

Direct leak of 64 byte(s) in 1 object(s) allocated from:
	    #0 0x5747417eabd9 in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3
	    #1 0x574742706f5b in _cairo_memory_stream_create cairo/src/cairo-output-stream.c:741:14
	    #2 0x5747426757b8 in _cairo_pdf_surface_open_object_stream cairo/src/cairo-pdf-surface.c:2307:34
	    #3 0x57474266b880 in _cairo_pdf_surface_finish cairo/src/cairo-pdf-surface.c:2700:14
	    #4 0x57474261afc6 in _cairo_surface_finish cairo/src/cairo-surface.c:1043:11
	    #5 0x57474261afc6 in cairo_surface_finish cairo/src/cairo-surface.c:1092:5
	    #6 0x57474270808a in _cairo_paginated_surface_finish cairo/src/cairo-paginated-surface.c:215:2
	    #7 0x5747426175c2 in _cairo_surface_finish cairo/src/cairo-surface.c:1043:11
	    #8 0x5747426175c2 in cairo_surface_destroy cairo/src/cairo-surface.c:978:2

This fixes it.

_cairo_pdf_surface_finish was succeeding past
_cairo_pdf_surface_open_object_stream that allocates surface->object_stream.stream,
failing when calling _cairo_pdf_surface_emit_font_subsets
and that memory was never freed
This commit is contained in:
Albert Astals Cid 2026-01-24 11:37:50 +01:00
parent 200a02286b
commit b94bf30f03
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/cairo-pdf-surface.c
View file

@ -2793,6 +2793,11 @@ _cairo_pdf_surface_finish (void *abstract_surface)
if (status == CAIRO_STATUS_SUCCESS)
status = status2;
}
if (surface->object_stream.stream != NULL) {
status2 = _cairo_output_stream_destroy (surface->object_stream.stream);
if (status == CAIRO_STATUS_SUCCESS)
status = status2;
}
if (surface->pdf_stream.active)
surface->output = surface->pdf_stream.old_output;
if (surface->group_stream.active)