From ab0a68021ab4936c12d874997db580963d0e787b Mon Sep 17 00:00:00 2001 From: Jan Horak Date: Tue, 16 Oct 2018 10:39:26 +0200 Subject: Fix use after free in error reporting --- src/io/uristream.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/io/uristream.cpp b/src/io/uristream.cpp index ff4cca74d..9fd0d9c96 100644 --- a/src/io/uristream.cpp +++ b/src/io/uristream.cpp @@ -321,11 +321,14 @@ UriOutputStream::UriOutputStream(Inkscape::URI &destination) //printf("out path:'%s'\n", cpath); outf = fopen_utf8name(cpath, FILE_WRITE); //outf = fopen(cpath, "wb"); - g_free(cpath); + if (!outf) { Glib::ustring err = "UriOutputStream cannot open file "; err += cpath; + g_free(cpath); throw StreamException(err); + } else { + g_free(cpath); } break; -- cgit v1.2.3 From 80b401535eb43f68d6e23c5a874dceb3bc64d3f4 Mon Sep 17 00:00:00 2001 From: Jan Horak Date: Tue, 16 Oct 2018 10:50:27 +0200 Subject: Nulling pointer after destroying its data. --- src/3rdparty/libcroco/cr-om-parser.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src') diff --git a/src/3rdparty/libcroco/cr-om-parser.c b/src/3rdparty/libcroco/cr-om-parser.c index 596cd6e6b..7e1127e41 100644 --- a/src/3rdparty/libcroco/cr-om-parser.c +++ b/src/3rdparty/libcroco/cr-om-parser.c @@ -691,6 +691,7 @@ property (CRDocHandler * a_this, (ctxt->cur_stmt->kind.ruleset->decl_list, decl); if (!decl2) { cr_declaration_destroy (decl); + decl = NULL; cr_utils_trace_info ("Could not append decl to ruleset"); goto error; @@ -706,6 +707,7 @@ property (CRDocHandler * a_this, decl); if (!decl2) { cr_declaration_destroy (decl); + decl = NULL; cr_utils_trace_info ("Could not append decl to ruleset"); goto error; @@ -719,6 +721,7 @@ property (CRDocHandler * a_this, (ctxt->cur_stmt->kind.page_rule->decl_list, decl); if (!decl2) { cr_declaration_destroy (decl); + decl = NULL; cr_utils_trace_info ("Could not append decl to ruleset"); goto error; -- cgit v1.2.3