Commit 1c3ecfac authored by Bryce Harrington's avatar Bryce Harrington
Browse files

snapshot: Don't use extra after it's been freed (CID #220086)

Note this changes the semantics of the value of extra_out such that it
is set to NULL instead of left undefined in case an error is returned.

Coverity ID: 220086
Signed-off-by: Bryce Harrington's avatarBryce Harrington <>
Reviewed-By: Uli Schlachter's avatarUli Schlachter <>
parent 37655af3
...@@ -100,14 +100,17 @@ _cairo_surface_snapshot_acquire_source_image (void *abstract_ ...@@ -100,14 +100,17 @@ _cairo_surface_snapshot_acquire_source_image (void *abstract_
cairo_status_t status; cairo_status_t status;
extra = _cairo_malloc (sizeof (*extra)); extra = _cairo_malloc (sizeof (*extra));
if (unlikely (extra == NULL)) if (unlikely (extra == NULL)) {
*extra_out = NULL;
return _cairo_error (CAIRO_STATUS_NO_MEMORY); return _cairo_error (CAIRO_STATUS_NO_MEMORY);
extra->target = _cairo_surface_snapshot_get_target (&surface->base); extra->target = _cairo_surface_snapshot_get_target (&surface->base);
status = _cairo_surface_acquire_source_image (extra->target, image_out, &extra->extra); status = _cairo_surface_acquire_source_image (extra->target, image_out, &extra->extra);
if (unlikely (status)) { if (unlikely (status)) {
cairo_surface_destroy (extra->target); cairo_surface_destroy (extra->target);
free (extra); free (extra);
extra = NULL;
} }
*extra_out = extra; *extra_out = extra;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment