Ondrej Dubaj dc2735f5a8 Potential double-free in gdImage*Ptr()
Whenever `gdImage*Ptr()` calls `gdImage*Ctx()` and the latter fails, we
must not call `gdDPExtractData()`; otherwise a double-free would
happen.  Since `gdImage*Ctx()` are void functions, and we can't change
that for BC reasons, we're introducing static helpers which are used
internally.

We're adding a regression test for `gdImageJpegPtr()`, but not for
`gdImageGifPtr()` and `gdImageWbmpPtr()` since we don't know how to
trigger failure of the respective `gdImage*Ctx()` calls.

This potential security issue has been reported by Solmaz Salimi (aka.
Rooney).
2019-11-01 09:21:22 +01:00
2017-08-30 16:13:52 +02:00
2019-11-01 09:21:22 +01:00
2017-08-30 16:13:52 +02:00
Description
Languages
RPM Spec 58.7%
Diff 41.3%