Skip to content

Commit

Permalink
r.out.png: fix consecutive fclose calls on same pointer (OSGeo#4214)
Browse files Browse the repository at this point in the history
This patch fixes two issues:

1. In one of the code paths, we are calling fclose on a
   file pointer which could potentially be NULL. Doing that
   would lead to undefined behavior. Check if a file pointer
   is NULL before closing it.

2. If we call fclose on same file pointer twice, in the
   second instance we could be closing file descriptor allocated
   to some other file, which typically happens to a freed
   descriptor.

This issue was found by using cppcheck tool.

Signed-off-by: Mohana Datta Yelugoti <ymdatta.work@gmail.com>
  • Loading branch information
ymdatta authored Aug 23, 2024
1 parent 1205137 commit 917ba58
Showing 1 changed file with 15 additions and 5 deletions.
20 changes: 15 additions & 5 deletions raster/r.out.png/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ int main(int argc, char *argv[])
int png_compr, /* ret, */ do_alpha;
struct Cell_head win;
FILEDESC cellfile = 0;
FILE *fp;
FILE *fp = NULL;

/* now goes from pnmtopng.c* -A.Sh */
/*
Expand Down Expand Up @@ -207,20 +207,29 @@ int main(int argc, char *argv[])
png_create_write_struct(PNG_LIBPNG_VER_STRING, &pnmtopng_jmpbuf_struct,
pnmtopng_error_handler, NULL);
if (png_ptr == NULL) {
fclose(fp);
if (fp) {
fclose(fp);
fp = NULL;
}
G_fatal_error("cannot allocate LIBPNG structure");
}

info_ptr = png_create_info_struct(png_ptr);
if (info_ptr == NULL) {
png_destroy_write_struct(&png_ptr, (png_infopp)NULL);
fclose(fp);
if (fp) {
fclose(fp);
fp = NULL;
}
G_fatal_error("cannot allocate LIBPNG structure");
}

if (setjmp(pnmtopng_jmpbuf_struct.jmpbuf)) {
png_destroy_write_struct(&png_ptr, &info_ptr);
fclose(fp);
if (fp) {
fclose(fp);
fp = NULL;
}
G_fatal_error("setjmp returns error condition (1)");
}

Expand Down Expand Up @@ -360,7 +369,8 @@ int main(int argc, char *argv[])
/* G_free (info_ptr); */
png_destroy_write_struct(&png_ptr, &info_ptr); /* al 11/2000 */

fclose(fp);
if (fp)
fclose(fp);

if (wld_flag->answer) {
if (do_stdout)
Expand Down

0 comments on commit 917ba58

Please sign in to comment.