Fix memory leak & tained value found by static analyzer

 - Memory leak
  GifMakeMapObject allocate storage for a color map object with the given number of RGB triplet slots.
  So the storage should be freed by calling GifFreeMapObject that is no longer needed.

 - Tained value
  GifWord is type of SWidth, SHeight. It is defined to be integer in Gif.
  So it is not tained to compare GifWord with integer. We add type cast to be clear.

Change-Id: I8c84e0ef05cfefb5f0f995be3bb14c69702a9d8b
Signed-off-by: jiyong.min <jiyong.min@samsung.com>

diff --git a/gif/mm_util_gif.c b/gif/mm_util_gif.c
index 3b92a2d147945f9469e1604882ad0ad82631a20a..1e12999d54758dd9875848f803bbe022e2622df0 100755 (executable)
--- a/gif/mm_util_gif.c
+++ b/gif/mm_util_gif.c
@@ -136,9 +136,9 @@ static int __read_gif(mm_util_gif_data *decoded, const char *filename, void *mem
                goto error;
        }
 
-       for (i = 0; i < GifFile->SWidth; i++)   /* Set its color to BackGround. */
+       for (i = 0; i < (int)(GifFile->SWidth); i++)    /* Set its color to BackGround. */
                screen_buffer[0][i] = GifFile->SBackGroundColor;
-       for (i = 1; i < GifFile->SHeight; i++) {
+       for (i = 1; i < (int)(GifFile->SHeight); i++) {
                /* Allocate the other rows, and set their color to background too: */
                if ((screen_buffer[i] = (GifRowType) calloc(1, Size)) == NULL) {
                        mm_util_error("Failed to allocate memory required, aborted.");
@@ -242,7 +242,7 @@ error:
        if (screen_buffer) {
                if (screen_buffer[0])
                        (void)free(screen_buffer[0]);
-               for (i = 1; i < GifFile->SHeight; i++) {
+               for (i = 1; i < (int)(GifFile->SHeight); i++) {
                        if (screen_buffer[i])
                                (void)free(screen_buffer[i]);
                }
@@ -445,6 +445,8 @@ int mm_util_encode_close_gif(mm_util_gif_data *encoded)
        return MM_UTIL_ERROR_NONE;
 }
 
+#define RGB_FREE(r, g, b) { free(r); free(g); free(b); }
+
 static int __write_gif(mm_util_gif_data *encoded)
 {
        int ColorMapSize;
@@ -467,36 +469,33 @@ static int __write_gif(mm_util_gif_data *encoded)
        }
 
        for (i = encoded->current_count; i < encoded->image_count; i++) {
+               /* allocate output buffer */
                if ((OutputBuffer = (GifByteType *) malloc(encoded->frames[i]->width * encoded->frames[i]->height * sizeof(GifByteType))) == NULL) {
                        mm_util_error("Failed to allocate memory required, aborted.");
                        mm_util_encode_close_gif(encoded);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
 
+               /* make colormap and quantization for the color table of gif */
                ColorMapSize = 1 << 8;
                __load_rgb_from_buffer((GifByteType *) encoded->frames[i]->data, &red, &green, &blue, encoded->frames[i]->width, encoded->frames[i]->height);
 
                if ((OutputColorMap = GifMakeMapObject(ColorMapSize, NULL)) == NULL) {
                        mm_util_error("could not map object");
-                       free((char *)red);
-                       free((char *)green);
-                       free((char *)blue);
+                       RGB_FREE((char *)red, (char *)green, (char *)blue);
                        free(OutputBuffer);
                        mm_util_encode_close_gif(encoded);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
                if (GifQuantizeBuffer(encoded->frames[i]->width, encoded->frames[i]->height, &ColorMapSize, red, green, blue, OutputBuffer, OutputColorMap->Colors) == GIF_ERROR) {
                        mm_util_error("could not quantize buffer");
-                       free((char *)red);
-                       free((char *)green);
-                       free((char *)blue);
+                       RGB_FREE((char *)red, (char *)green, (char *)blue);
                        free(OutputBuffer);
+                       GifFreeMapObject(OutputColorMap);
                        mm_util_encode_close_gif(encoded);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
-               free((char *)red);
-               free((char *)green);
-               free((char *)blue);
+               RGB_FREE((char *)red, (char *)green, (char *)blue);
 
                encoded->frames[i]->transparent_color.Red = 0xff;
                encoded->frames[i]->transparent_color.Green = 0xff;
@@ -510,14 +509,17 @@ static int __write_gif(mm_util_gif_data *encoded)
                encoded->frames[i]->disposal_mode = MM_UTIL_GIF_DISPOSAL_UNSPECIFIED;
                encoded->frames[i]->is_transparent = false;
 
+               /* encode OutputBuffer to GifFile */
                if (__save_buffer_to_gif(encoded->GifFile, OutputBuffer, OutputColorMap, encoded->frames[i]) != MM_UTIL_ERROR_NONE) {
                        mm_util_error("save_buffer_to_gif is failed");
                        free(OutputBuffer);
+                       GifFreeMapObject(OutputColorMap);
                        mm_util_encode_close_gif(encoded);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
 
                free(OutputBuffer);
+               GifFreeMapObject(OutputColorMap);
                encoded->current_count++;
        }
        encoded->size = encoded->write_data_ptr.size;

diff --git a/packaging/libmm-utility.spec b/packaging/libmm-utility.spec
index b4cb32a7578f5f7fb66e32db872a4dd43c5a5517..ca823f3867536fbec200f1bb988ed59b118c6f99 100755 (executable)
--- a/packaging/libmm-utility.spec
+++ b/packaging/libmm-utility.spec
@@ -1,6 +1,6 @@
 Name:       libmm-utility
 Summary:    Multimedia Framework Utility Library
-Version:    0.27
+Version:    0.28
 Release:    0
 Group:      System/Libraries
 License:    Apache-2.0