Re: Corrupted heap

[Fred Kiefer]

Am 17.03.2010 20:26, schrieb Adam Fedor:
> 
> On Mar 17, 2010, at 12:34 PM, Vincent Richomme wrote:
>>
>>
>> /* Return YES if this looks like a JPEG. */
>> + (BOOL) _bitmapIsJPEG: (NSData *)imageData
>> {
>>  struct jpeg_decompress_struct  cinfo;
>>
>> ... BLABLA ...
>>
>> // establish return context for error handling
>>  if (setjmp(jerrMgr.setjmpBuffer))
>>    {
>>      gs_jpeg_memory_src_destroy(&cinfo);
>>      jpeg_destroy_decompress(&cinfo);
>>      return NO;
>>    }
>>
>> ... BLABLA ...
>>
>>   return YES;
>> }
>>
>> Are you sure you need to call free here because I suppose &cinfo->src is 
>> not yet valid.
> 
> That looks wrong to me as well.
> 
In itself this could be correct. setjmp() will return non-zero when
called via longjmp, that is, this is the error case, where we need to
clean up. Still the code isn't writen in a save way. We should first
bring the structure in a defined state, we never know at what point an
error will happen.