Add to copy & to release the input buffer recieved from application

(To prevent crash when application release the buffer)

Change-Id: Idfd9e82516ccdc4b7ad4ad8e402dfe7a9a39321e

diff --git a/src/image_util_decode.c b/src/image_util_decode.c
index 9aa887e..0007b1a 100755 (executable)
--- a/src/image_util_decode.c
+++ b/src/image_util_decode.c
@@ -158,10 +158,13 @@ int image_util_decode_set_input_path(image_util_decode_h handle, const char *pat
        }
 
        IMAGE_UTIL_SAFE_FREE(image_header);
+       IMAGE_UTIL_SAFE_G_FREE(_handle->path);
 
        _handle->path = g_strndup(path, strlen(path));
        image_util_retvm_if(_handle->path == NULL, IMAGE_UTIL_ERROR_OUT_OF_MEMORY, "OUT_OF_MEMORY");
 
+       IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
+
        return err;
 }
 
@@ -173,14 +176,19 @@ int image_util_decode_set_input_buffer(image_util_decode_h handle, const unsigne
        image_util_retvm_if(_handle == NULL, IMAGE_UTIL_ERROR_INVALID_PARAMETER, "Invalid Handle");
        image_util_retvm_if((src_buffer == NULL || src_size < IMG_HEADER_LENGTH), IMAGE_UTIL_ERROR_INVALID_PARAMETER, "Invalid input buffer");
 
-       IMAGE_UTIL_SAFE_FREE(_handle->path);
-
        err = _image_util_decode_check_image_type(src_buffer, &_handle->image_type);
        image_util_retvm_if(err != IMAGE_UTIL_ERROR_NONE, err, "_image_util_decode_check_image_type failed");
 
-       _handle->src_buffer = (void *)src_buffer;
+       IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
+
+       _handle->src_buffer = calloc(1, src_size);
+       image_util_retvm_if(!_handle->src_buffer, IMAGE_UTIL_ERROR_OUT_OF_MEMORY, "OUT_OF_MEMORY");
+
+       memcpy(_handle->src_buffer, src_buffer, src_size);
        _handle->src_size = src_size;
 
+       IMAGE_UTIL_SAFE_G_FREE(_handle->path);
+
        return err;
 }
 
@@ -229,7 +237,7 @@ int image_util_decode_set_jpeg_downscale(image_util_decode_h handle, image_util_
        return IMAGE_UTIL_ERROR_NONE;
 }
 
-static int __image_util_decode_internal(decode_s * _handle, mm_util_image_h *image_info)
+static int __image_util_decode_internal(decode_s *_handle, mm_util_image_h *image_info)
 {
        int err = MM_UTIL_ERROR_NONE;
        int colorspace = 0;
@@ -452,7 +460,6 @@ gpointer _image_util_decode_thread(gpointer data)
                mm_image_destroy_image(image_info);
                IMAGE_UTIL_SAFE_FREE(_handle->decode2_cb);
                IMAGE_UTIL_SAFE_G_FREE(_handle->path);
-
        } else {
                ret = __image_util_decode_internal(_handle, &image_info);
                if (ret == IMAGE_UTIL_ERROR_NONE)
@@ -582,7 +589,8 @@ int image_util_decode_destroy(image_util_decode_h handle)
                g_thread_join(_handle->thread);
                IMAGE_UTIL_SAFE_FREE(_handle->_decode_cb);
        }
-       IMAGE_UTIL_SAFE_FREE(_handle->path);
+       IMAGE_UTIL_SAFE_G_FREE(_handle->path);
+       IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
        IMAGE_UTIL_SAFE_FREE(_handle);
 
        image_util_fleave();