diff --git a/cursor/parse_cursor_file.c b/cursor/parse_cursor_file.c index 30f7df5..ad98c03 100644 --- a/cursor/parse_cursor_file.c +++ b/cursor/parse_cursor_file.c @@ -107,6 +107,8 @@ int parse_cursor_file(xcb_cursor_context_t *c, const int fd, xcint_image_t **ima /* Read the table of contents */ cf.tocs = malloc(cf.header.ntoc * sizeof(xcint_file_toc_t)); + if (!cf.tocs) + return -EINVAL; read(fd, cf.tocs, cf.header.ntoc * sizeof(xcint_file_toc_t)); for (int n = 0; n < cf.header.ntoc; n++) { cf.tocs[n].type = le32toh(cf.tocs[n].type); @@ -166,6 +168,11 @@ int parse_cursor_file(xcb_cursor_context_t *c, const int fd, xcint_image_t **ima } numpixels = i->width * i->height; i->pixels = malloc(numpixels * sizeof(uint32_t)); + if (!i->pixels) { + /* XXX: This leaks images[i]->pixels for other values of i and images itself */ + free(cf.tocs); + return -EINVAL; + } read(fd, i->pixels, numpixels * sizeof(uint32_t)); p = i->pixels; for (int j = 0; j < numpixels; j++, p++)