From: jiyong.min <jiyong.min@samsung.com>
Date: Wed, 24 Apr 2019 00:00:08 +0000 (+0900)
Subject: Add to copy & to release the input buffer recieved from application
X-Git-Tag: submit/tizen_5.0/20190424.053624^0
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=d421f60c0765feb2d95a98f2f3c777eea41618e0;p=platform%2Fcore%2Fapi%2Fimage-util.git

Add to copy & to release the input buffer recieved from application
(To prevent crash when application release the buffer)

Change-Id: Idfd9e82516ccdc4b7ad4ad8e402dfe7a9a39321e
---

diff --git a/include/image_util_private.h b/include/image_util_private.h
index 8c4c090..a47c444 100755
--- a/include/image_util_private.h
+++ b/include/image_util_private.h
@@ -76,6 +76,7 @@ extern "C"
 	((str != NULL && strlen(str) > 0) ? true : false)
 
 #define IMAGE_UTIL_SAFE_FREE(src)	{ if (src) {free(src); src = NULL; } }
+#define IMAGE_UTIL_SAFE_G_FREE(src)     { if (src) {g_free(src); src = NULL; } }
 
 #define _NOT_SUPPORTED_COLORSPACE	(-1)
 
diff --git a/packaging/capi-media-image-util.spec b/packaging/capi-media-image-util.spec
index 7c6ef5e..c926041 100755
--- a/packaging/capi-media-image-util.spec
+++ b/packaging/capi-media-image-util.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-image-util
 Summary:    A Image Utility library in Tizen Native API
-Version:    0.1.42
+Version:    0.1.43
 Release:    2
 Group:      Multimedia/API
 License:    Apache-2.0
diff --git a/src/image_util_decode.c b/src/image_util_decode.c
index 4b0aabc..95cfe3c 100644
--- a/src/image_util_decode.c
+++ b/src/image_util_decode.c
@@ -183,6 +183,7 @@ int image_util_decode_set_input_path(image_util_decode_h handle, const char *pat
 	}
 
 	IMAGE_UTIL_SAFE_FREE(image_header);
+	IMAGE_UTIL_SAFE_G_FREE(_handle->path);
 
 	err = _image_util_decode_create_image_handle(_handle);
 	image_util_retvm_if((err != IMAGE_UTIL_ERROR_NONE), err, "_image_util_decode_create_image_handle failed");
@@ -190,6 +191,8 @@ int image_util_decode_set_input_path(image_util_decode_h handle, const char *pat
 	_handle->path = g_strndup(path, strlen(path));
 	image_util_retvm_if(_handle->path == NULL, IMAGE_UTIL_ERROR_OUT_OF_MEMORY, "OUT_OF_MEMORY");
 
+	IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
+
 	return err;
 }
 
@@ -201,22 +204,31 @@ int image_util_decode_set_input_buffer(image_util_decode_h handle, const unsigne
 	IMAGE_UTIL_DECODE_HANDLE_CHECK(handle);
 	image_util_retvm_if((src_buffer == NULL || src_size < IMG_HEADER_LENGTH), IMAGE_UTIL_ERROR_INVALID_PARAMETER, "Invalid input buffer");
 
-	IMAGE_UTIL_SAFE_FREE(_handle->path);
-
 	err = _image_util_decode_check_image_type(src_buffer, &_handle->image_type);
 	image_util_retvm_if(err != IMAGE_UTIL_ERROR_NONE, err, "_image_util_decode_check_image_type failed");
 
 	err = _image_util_decode_create_image_handle(_handle);
 	image_util_retvm_if(err != IMAGE_UTIL_ERROR_NONE, err, "_image_util_decode_create_image_handle failed");
 
+	if (_handle->src_buffer)
+		IMAGE_UTIL_SAFE_FREE(_handle->src_buffer[0]);
 	IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
 
 	_handle->src_buffer = (void *)calloc(1, sizeof(void *));
 	image_util_retvm_if(_handle->src_buffer == NULL, IMAGE_UTIL_ERROR_OUT_OF_MEMORY, "The memory of input buffer was not allocated");
 
-	_handle->src_buffer[0] = (void *)src_buffer;
+	_handle->src_buffer[0] = calloc(1, src_size);
+	if (!_handle->src_buffer[0]) {
+		image_util_error("The memory of input buffer was not allocated");
+		IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
+		return IMAGE_UTIL_ERROR_OUT_OF_MEMORY;
+	}
+
+	memcpy(_handle->src_buffer[0], src_buffer, src_size);
 	_handle->src_size = src_size;
 
+	IMAGE_UTIL_SAFE_G_FREE(_handle->path);
+
 	return err;
 }
 
@@ -479,7 +491,9 @@ int image_util_decode_destroy(image_util_decode_h handle)
 		g_thread_join(_handle->thread);
 		IMAGE_UTIL_SAFE_FREE(_handle->_decode_cb);
 	}
-	IMAGE_UTIL_SAFE_FREE(_handle->path);
+	IMAGE_UTIL_SAFE_G_FREE(_handle->path);
+	if (_handle->src_buffer)
+		IMAGE_UTIL_SAFE_FREE(_handle->src_buffer[0]);
 	IMAGE_UTIL_SAFE_FREE(_handle->src_buffer);
 	IMAGE_UTIL_SAFE_FREE(_handle);