After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 776026 - Coverity fixes
Coverity fixes
Status: RESOLVED FIXED
Product: gdk-pixbuf
Classification: Platform
Component: general
unspecified
Other All
: Normal normal
: ---
Assigned To: gdk-pixbuf-maint
gdk-pixbuf-maint
Depends on:
Blocks:
 
 
Reported: 2016-12-12 23:12 UTC by Philip Withnall
Modified: 2016-12-19 18:03 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
io-gif: Clarify buffer length management (1.12 KB, patch)
2016-12-12 23:12 UTC, Philip Withnall
committed Details | Review
thumbnailer: Fix a potential NULL pointer dereference (1.11 KB, patch)
2016-12-12 23:12 UTC, Philip Withnall
committed Details | Review
io-jpeg: Fix a potential infinite loop when failing to write out (1.19 KB, patch)
2016-12-12 23:12 UTC, Philip Withnall
committed Details | Review

Description Philip Withnall 2016-12-12 23:12:37 UTC
Various miscellaneous fixes resulting from doing some scanning of gdk-pixbuf with Coverity. Nothing particularly interesting so far; mostly problems in error handling paths.
Comment 1 Philip Withnall 2016-12-12 23:12:41 UTC
Created attachment 341852 [details] [review]
io-gif: Clarify buffer length management

buffer_count is read from the file, and then we potentially copy up to
that number of bytes straight into a buffer without a length check. This
does not result in buffer overflow iff the buffer is at least 255 bytes
long. Make that clear.

Coverity CID 609094
Comment 2 Philip Withnall 2016-12-12 23:12:45 UTC
Created attachment 341853 [details] [review]
thumbnailer: Fix a potential NULL pointer dereference

In debug code on an error path: if the loader is not loaded due to
mime_type being NULL, no error is set; so dereferencing it is a bad
idea.

Coverity CID 1388530
Comment 3 Philip Withnall 2016-12-12 23:12:49 UTC
Created attachment 341854 [details] [review]
io-jpeg: Fix a potential infinite loop when failing to write out

If libjpeg fails to write out a scan line, this loop would never have
terminated (as next_scanline would never be incremented). Fix that by
checking for the return value from jpeg_write_scanlines().

Coverity CID 1388533
Comment 4 Bastien Nocera 2016-12-19 18:03:18 UTC
Attachment 341852 [details] pushed as 5b15f34 - io-gif: Clarify buffer length management
Attachment 341853 [details] pushed as 49dcd2d - thumbnailer: Fix a potential NULL pointer dereference
Attachment 341854 [details] pushed as 5916326 - io-jpeg: Fix a potential infinite loop when failing to write out