RESOURCE_LEAK in /inkbugs/inkscape/src/display/nr-filter-slot.cpp
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Inkscape |
Fix Released
|
Medium
|
Unassigned |
Bug Description
RESOURCE_LEAK in /inkbugs/
In Inkscape:
Leak of memory or pointers to system resources (CWE-404).
194 if (slot_nr == NR_FILTER_
195 Geom::Matrix trans = units.get_
196 if (fabs(trans[1]) > 1e-6 || fabs(trans[2]) > 1e-6) {
Calling allocation function "operator new(unsigned int)".
Assigning: "trans_pb" = storage returned from "new NRPixBlock".
197 NRPixBlock *trans_pb = new NRPixBlock;
198 int x0 = pb->area.x0;
199 int y0 = pb->area.y0;
200 int x1 = pb->area.x1;
201 int y1 = pb->area.y1;
202 int min_x = _min4(trans[0] * x0 + trans[2] * y0 + trans[4],
203 trans[0] * x0 + trans[2] * y1 + trans[4],
204 trans[0] * x1 + trans[2] * y0 + trans[4],
205 trans[0] * x1 + trans[2] * y1 + trans[4]);
206 int max_x = _max4(trans[0] * x0 + trans[2] * y0 + trans[4],
207 trans[0] * x0 + trans[2] * y1 + trans[4],
208 trans[0] * x1 + trans[2] * y0 + trans[4],
209 trans[0] * x1 + trans[2] * y1 + trans[4]);
210 int min_y = _min4(trans[1] * x0 + trans[3] * y0 + trans[5],
211 trans[1] * x0 + trans[3] * y1 + trans[5],
212 trans[1] * x1 + trans[3] * y0 + trans[5],
213 trans[1] * x1 + trans[3] * y1 + trans[5]);
214 int max_y = _max4(trans[1] * x0 + trans[3] * y0 + trans[5],
215 trans[1] * x0 + trans[3] * y1 + trans[5],
216 trans[1] * x1 + trans[3] * y0 + trans[5],
217 trans[1] * x1 + trans[3] * y1 + trans[5]);
218
Variable "trans_pb" is not freed or pointed-to in function "nr_pixblock_
219 nr_pixblock_
220 min_x, min_y,
221 max_x, max_y, true);
At conditional (1): "trans_pb->size != 0" taking the true branch.
At conditional (2): "trans_pb->data.px == NULL" taking the true branch.
222 if (trans_pb->size != NR_PIXBLOCK_
223 /* TODO: this gets hit occasionally. Worst case scenario:
224 * images are exported in horizontal stripes. One stripe
225 * is not too high, but can get thousands of pixels wide.
226 * Rotate this 45 degrees -> _huge_ image */
227 g_warning("Memory allocation failed in Inkscape:
Variable "trans_pb" going out of scope leaks the storage it points to.
228 return;
229 }
230 if (filterquality == FILTER_
231 NR::transform_
232 } else {
233 NR::transform_
234 }
235 nr_pixblock_
236 delete pb;
237 pb = trans_pb;
238 } else if (fabs(trans[0] - 1) > 1e-6 || fabs(trans[3] - 1) > 1e-6) {
Changed in inkscape: | |
status: | New → Triaged |
tags: | added: performance |
Changed in inkscape: | |
status: | Fix Committed → Fix Released |
fix suggestion 2010-07-25:
227.1 delete trans_pb;
fix reason:
insert line to release trans_pb before return.