dc2735f Potential double-free in gdImage*Ptr()

Authored and Committed by odubaj 4 years ago
    Potential double-free in gdImage*Ptr()
    
    Whenever `gdImage*Ptr()` calls `gdImage*Ctx()` and the latter fails, we
    must not call `gdDPExtractData()`; otherwise a double-free would
    happen.  Since `gdImage*Ctx()` are void functions, and we can't change
    that for BC reasons, we're introducing static helpers which are used
    internally.
    
    We're adding a regression test for `gdImageJpegPtr()`, but not for
    `gdImageGifPtr()` and `gdImageWbmpPtr()` since we don't know how to
    trigger failure of the respective `gdImage*Ctx()` calls.
    
    This potential security issue has been reported by Solmaz Salimi (aka.
    Rooney).
    
        
file modified
+5 -0