commit 3ec41044d35d2586d7befa56366d211b44377e2e
Author: Nils Philippsen <nils@redhat.com>
Date:   Mon Dec 7 16:23:01 2009 +0100

    SGI: avoid double frees
    
    Freeing both rows[0] and rows caused glibc to flag invalid pointers.
    Handle this the same way as pixel/pixels with rows/rows_data.

diff --git a/plug-ins/file-sgi/sgi.c b/plug-ins/file-sgi/sgi.c
index ae59da4..a854ae4 100644
--- a/plug-ins/file-sgi/sgi.c
+++ b/plug-ins/file-sgi/sgi.c
@@ -312,7 +312,8 @@ load_image (const gchar  *filename,
   guchar       **pixels,      /* Pixel rows */
                 *pixel,       /* Pixel data */
                 *pptr;        /* Current pixel */
-  gushort      **rows;        /* SGI image data */
+  gushort      **rows;        /* SGI image rows pointers */
+  gushort       *rows_data;   /* SGI image rows data */
 
  /*
   * Open the file for reading...
@@ -426,11 +427,11 @@ load_image (const gchar  *filename,
   for (i = 0; i < tile_height; i ++)
     pixels[i] = pixel + sgip->xsize * bytes * i;
 
-  rows    = g_new (unsigned short *, sgip->zsize);
-  rows[0] = g_new (unsigned short, ((gsize)sgip->xsize) * sgip->zsize);
+  rows      = g_new (unsigned short *, sgip->zsize);
+  rows_data = g_new (unsigned short, ((gsize)sgip->xsize) * sgip->zsize);
 
-  for (i = 1; i < sgip->zsize; i ++)
-    rows[i] = rows[0] + i * sgip->xsize;
+  for (i = 0; i < sgip->zsize; i ++)
+    rows[i] = rows_data + i * sgip->xsize;
 
   /*
    * Load the image...
@@ -491,7 +492,7 @@ load_image (const gchar  *filename,
 
   g_free (pixel);
   g_free (pixels);
-  g_free (rows[0]);
+  g_free (rows_data);
   g_free (rows);
 
   /*
@@ -527,7 +528,8 @@ save_image (const gchar  *filename,
   guchar    **pixels,      /* Pixel rows */
              *pixel,       /* Pixel data */
              *pptr;        /* Current pixel */
-  gushort   **rows;        /* SGI image data */
+  gushort   **rows;        /* SGI image rows pointers */
+  gushort    *rows_data;   /* SGI image rows data */
 
   /*
    * Get the drawable for the current image...
@@ -586,11 +588,11 @@ save_image (const gchar  *filename,
   for (i = 0; i < tile_height; i ++)
     pixels[i]= pixel + drawable->width * zsize * i;
 
-  rows    = g_new (gushort *, sgip->zsize);
-  rows[0] = g_new (gushort, ((gsize)sgip->xsize) * sgip->zsize);
+  rows      = g_new (gushort *, sgip->zsize);
+  rows_data = g_new (gushort, ((gsize)sgip->xsize) * sgip->zsize);
 
-  for (i = 1; i < sgip->zsize; i ++)
-    rows[i] = rows[0] + i * sgip->xsize;
+  for (i = 0; i < sgip->zsize; i ++)
+    rows[i] = rows_data + i * sgip->xsize;
 
   /*
    * Save the image...
@@ -634,7 +636,7 @@ save_image (const gchar  *filename,
 
   g_free (pixel);
   g_free (pixels);
-  g_free (rows[0]);
+  g_free (rows_data);
   g_free (rows);
 
   return TRUE;
