realloc の戻り値を見ていない部分を見るように修正

git-svn-id: svn+ssh://svn.sourceforge.jp/svnroot/swfed/trunk@556 7c90b180-03d5-4157-b861-58a559ae9d1e

diff --git a/src/swf_gif.c b/src/swf_gif.c
index b8b76d7..c161c69 100644 (file)
--- a/src/swf_gif.c
+++ b/src/swf_gif.c
@@ -62,17 +62,19 @@ gif_data_write_func(GifFileType* GifFile, const GifByteType* buf, int count)
 {
     my_gif_buffer *gif_buff = (my_gif_buffer *) GifFile->UserData;
     unsigned long new_data_len;
+    unsigned char *tmp;
     if (gif_buff->data_offset + count > gif_buff->data_len) {
         new_data_len = 2 * gif_buff->data_len;
         if (gif_buff->data_offset + count > new_data_len) {
             new_data_len = gif_buff->data_offset + count;
         }
-        gif_buff->data = realloc(gif_buff->data, new_data_len);
-        if (gif_buff->data == NULL) {
+        tmp = realloc(gif_buff->data, new_data_len);
+        if (tmp == NULL) {
             fprintf(stderr, "gif_data_write_func: can't realloc: new_data_len(%lu), data_len(%lu)\n",
                     new_data_len, gif_buff->data_len);
             return 0;
         }
+        gif_buff->data = tmp;
         gif_buff->data_len = new_data_len;
     }
     memcpy(gif_buff->data + gif_buff->data_offset, buf, count);

diff --git a/src/swf_png.c b/src/swf_png.c
index 5651532..b82a549 100644 (file)
--- a/src/swf_png.c
+++ b/src/swf_png.c
@@ -54,18 +54,19 @@ void
 png_data_write_func(png_structp png_ptr, png_bytep buf, png_size_t size) {
     my_png_buffer *png_buff = (my_png_buffer *)png_get_io_ptr(png_ptr);
     unsigned long new_data_len;
+    unsigned char *tmp;
     if (png_buff->data_offset + size > png_buff->data_len) {
         new_data_len = 2 * png_buff->data_len;
         if (png_buff->data_offset + size > new_data_len) {
             new_data_len = png_buff->data_offset + size;
         }
-        png_buff->data = realloc(png_buff->data, new_data_len);
-        if (png_buff->data == NULL) {
+        tmp = realloc(png_buff->data, new_data_len);
+        if (tmp == NULL) {
             fprintf(stderr, "png_data_write_func: can't realloc: new_data_len(%lu), data_len(%lu)\n",
                     new_data_len, png_buff->data_len);
             png_error(png_ptr,"png_data_write_func failed");
-
         }
+        png_buff->data = tmp;
         png_buff->data_len = new_data_len;
     }
     memcpy(png_buff->data + png_buff->data_offset, buf, size);

diff --git a/src/swf_tag_jpeg.c b/src/swf_tag_jpeg.c
index 113dd13..d235c9f 100644 (file)
--- a/src/swf_tag_jpeg.c
+++ b/src/swf_tag_jpeg.c
@@ -177,6 +177,12 @@ swf_tag_jpeg3_input_detail(swf_tag_t *tag,
     if (result == Z_BUF_ERROR) { // XXX
         origsize *= 2;
         new_buff = realloc(new_buff, origsize); // enough size?
+        if (new_buff == NULL) {
+            free(swf_tag_jpeg);
+            bitstream_close(bs);
+            fprintf(stderr, "swf_tag_jpeg3_create_detail: realloc(%p, %d) failed\n", new_buff, origsize);
+            return 1;
+        }
         result = uncompress(new_buff, &origsize, old_buff_ref, alpha_data_len);
     }
     if (result == Z_OK) {