Bug#650488: Regarding Debian Bug report logs - #650488

[Deniz Eren]

Hi,

I've run into crash problems with h5utils program h5topng. I've read the bug report thread #650488 and am using h5utils 1.12.1-2 on Ubuntu 12.04 desktop with kernel 3.2.0-25-generic-pae.

The crash occurs on line 443 of writepng.c which is:

     /* if you malloced the palette, free it here */
#if PNG_LIBPNG_VER_MAJOR >= 1 && PNG_LIBPNG_VER_MINOR >= 4
     png_free(png_ptr, palette);
     palette = NULL;
#else
     free(info_ptr->palette);
#endif

The problem is with calling png_free on line 443 because there is no check for whether or not the palette was malloced. In the function writepng where the malloc occurs the value of 'eight_bit' is checked; if 'eight_bit' is true then the palette is malloced.

Therefore the same 'eight_bit' needs to be checked on line 443 before png_free is called. When I apply this change the crash problem is fixed.
The fix should be:

     /* if you malloced the palette, free it here */
#if PNG_LIBPNG_VER_MAJOR >= 1 && PNG_LIBPNG_VER_MINOR >= 4
     if (eight_bit) {
          png_free(png_ptr, palette);
     }

     palette = NULL;
#else
     free(info_ptr->palette);
#endif

Can you please review my suggestion and let me know what you think?



Best regards,
Deniz Eren

 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/pkg-grass-devel/attachments/20120617/74f84116/attachment-0001.html>