Bug 6196

Summary: Memory leak in _cairo_clip_intersect_path (src/cairo-clip.c)
Product: cairo Reporter: Ken Herron <kherron+cairo>
Component: generalAssignee: Carl Worth <cworth>
Status: RESOLVED FIXED QA Contact: cairo-bugs mailing list <cairo-bugs>
Severity: normal    
Priority: high    
Version: 1.1.1   
Hardware: All   
OS: All   
URL: http://gitweb.freedesktop.org/?p=cairo;a=blob;h=c76ebdcbf70be48ee3f4596fab295add31157cc2;hb=92e09ee72fdde9059300b2b63d87e2bbd4286605;f=src/cairo-clip.c#l246
Whiteboard:
i915 platform: i915 features:

Description Ken Herron 2006-03-10 04:26:30 UTC 
This was found through a coverity scan of the firefox source code.

The sample URL points to the relevant code in git. At line 246 a
|cairo_clip_path_t| object is allocated and stored in clip_path. At lines
250-252, the function returns without freeing this memory if
|_cairo_path_fixed_init_copy| fails.
Comment 1 Carl Worth 2006-03-14 07:23:14 UTC 
This is now fixed in cairo 1.1.1 and 1.0.3.

-Carl

diff-tree 79075b2cb1ce1397506fc10572df96f6fd00ecc3 (from
fc51a78a1ed5f7649ce55ab30fc42939a9b295d1)
Author: Carl Worth <cworth@cworth.org>
Date:   Mon Mar 13 12:20:23 2006 -0800

    cairo-clip: Fix memory leak during OOM handling.

    This closes bug #6196:

        Memory leak in _cairo_clip_intersect_path (src/cairo-clip.c)
        https://bugs.freedesktop.org/show_bug.cgi?id=6196

diff --git a/src/cairo-clip.c b/src/cairo-clip.c
index c76ebdc..0c862a3 100644
--- a/src/cairo-clip.c
+++ b/src/cairo-clip.c
@@ -248,8 +248,10 @@ _cairo_clip_intersect_path (cairo_clip_t
        return CAIRO_STATUS_NO_MEMORY;

     status = _cairo_path_fixed_init_copy (&clip_path->path, path);
-    if (status)
+    if (status) {
+       free (clip_path);
        return status;
+    }

     clip_path->ref_count = 1;
     clip_path->fill_rule = fill_rule;

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.