Add to copy & to release the input buffer recieved from application

(To prevent crash when application release the buffer)

Change-Id: Idfd9e82516ccdc4b7ad4ad8e402dfe7a9a39321e

diff --git a/include/image_util_private.h b/include/image_util_private.h
index 8c4c0902294126be0f25b30bebc4175cd68ded7f..a47c444404b08277a23ff5d86933a0a6ed33b6c9 100755 (executable)
--- a/include/image_util_private.h
+++ b/include/image_util_private.h
@@ -76,6 +76,7 @@ extern "C"
        ((str != NULL && strlen(str) > 0) ? true : false)
 
 #define IMAGE_UTIL_SAFE_FREE(src)      { if (src) {free(src); src = NULL; } }
+#define IMAGE_UTIL_SAFE_G_FREE(src)     { if (src) {g_free(src); src = NULL; } }
 
 #define _NOT_SUPPORTED_COLORSPACE      (-1)
 

diff --git a/packaging/capi-media-image-util.spec b/packaging/capi-media-image-util.spec
index 7c6ef5e5d8926b9baa227c4d8fef0f7b33521d8f..c926041ee1cc38ade83154ac04eefd0921554d65 100755 (executable)
--- a/packaging/capi-media-image-util.spec
+++ b/packaging/capi-media-image-util.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-image-util
 Summary:    A Image Utility library in Tizen Native API
-Version:    0.1.42
+Version:    0.1.43
 Release:    2
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/image_util_decode.c b/src/image_util_decode.c
index 4b0aabc2fc7aced94fedf286c97e12868b6d38ef..95cfe3c9b8e18c1fcc39cbdc88ee7344a6819634 100644 (file)
--- a/src/image_util_decode.c
+++ b/src/image_util_decode.c
@@ -183,6 +183,7 @@ int image_util_decode_set_input_path(image_util_decode_h handle, const char *pat
        }
 
        IMAGE_UTIL_SAFE_FREE(image_header);
+       IMAGE_UTIL_SAFE_G_FREE(_handle->path);
 
        err = _image_util_decode_create_image_handle(_handle);
        image_util_retvm_if((err != IMAGE_UTIL_ERROR_NONE), err, "_image_util_decode_create_image_handle failed");
@@ -190,6 +191,8 @@ int image_util_decode_set_input_path(image_util_decode_h handle, const char *pat
        _handle->path = g_strndup(path, strlen(path));
        image_util_retvm_if(_handle->path == NULL, IMAGE_UTIL_ERROR_OUT_OF_MEMORY, "OUT_OF_MEMORY");
 
+       IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
+
        return err;
 }
 
@@ -201,22 +204,31 @@ int image_util_decode_set_input_buffer(image_util_decode_h handle, const unsigne
        IMAGE_UTIL_DECODE_HANDLE_CHECK(handle);
        image_util_retvm_if((src_buffer == NULL || src_size < IMG_HEADER_LENGTH), IMAGE_UTIL_ERROR_INVALID_PARAMETER, "Invalid input buffer");
 
-       IMAGE_UTIL_SAFE_FREE(_handle->path);
-
        err = _image_util_decode_check_image_type(src_buffer, &_handle->image_type);
        image_util_retvm_if(err != IMAGE_UTIL_ERROR_NONE, err, "_image_util_decode_check_image_type failed");
 
        err = _image_util_decode_create_image_handle(_handle);
        image_util_retvm_if(err != IMAGE_UTIL_ERROR_NONE, err, "_image_util_decode_create_image_handle failed");
 
+       if (_handle->src_buffer)
+               IMAGE_UTIL_SAFE_FREE(_handle->src_buffer[0]);
        IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
 
        _handle->src_buffer = (void *)calloc(1, sizeof(void *));
        image_util_retvm_if(_handle->src_buffer == NULL, IMAGE_UTIL_ERROR_OUT_OF_MEMORY, "The memory of input buffer was not allocated");
 
-       _handle->src_buffer[0] = (void *)src_buffer;
+       _handle->src_buffer[0] = calloc(1, src_size);
+       if (!_handle->src_buffer[0]) {
+               image_util_error("The memory of input buffer was not allocated");
+               IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
+               return IMAGE_UTIL_ERROR_OUT_OF_MEMORY;
+       }
+
+       memcpy(_handle->src_buffer[0], src_buffer, src_size);
        _handle->src_size = src_size;
 
+       IMAGE_UTIL_SAFE_G_FREE(_handle->path);
+
        return err;
 }
 
@@ -479,7 +491,9 @@ int image_util_decode_destroy(image_util_decode_h handle)
                g_thread_join(_handle->thread);
                IMAGE_UTIL_SAFE_FREE(_handle->_decode_cb);
        }
-       IMAGE_UTIL_SAFE_FREE(_handle->path);
+       IMAGE_UTIL_SAFE_G_FREE(_handle->path);
+       if (_handle->src_buffer)
+               IMAGE_UTIL_SAFE_FREE(_handle->src_buffer[0]);
        IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
        IMAGE_UTIL_SAFE_FREE(_handle);