From: Anatol Belski <ab@php.net>
Date: Mon, 7 Mar 2016 15:38:47 +0000 (+0100)
Subject: fix double free and move temps into local scope
X-Git-Tag: php-7.0.5RC1~15
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f7e81fd9f15de2afdd23dc75c0341fc94664f2b3;p=php

fix double free and move temps into local scope
---

diff --git a/ext/gd/libgd/gd_webp.c b/ext/gd/libgd/gd_webp.c
index e85e9d9ffa..da0cc9d5b8 100644
--- a/ext/gd/libgd/gd_webp.c
+++ b/ext/gd/libgd/gd_webp.c
@@ -39,13 +39,14 @@ gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
 	int    width, height;
 	uint8_t   *filedata = NULL;
 	uint8_t    *argb = NULL;
-	unsigned char   *read, *temp;
 	size_t size = 0, n;
 	gdImagePtr im;
 	int x, y;
 	uint8_t *p;
 
 	do {
+		unsigned char *read, *temp;
+
 		temp = gdRealloc(filedata, size+GD_WEBP_ALLOC_STEP);
 		if (temp) {
 			filedata = temp;
@@ -66,19 +67,19 @@ gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
 
 	if (WebPGetInfo(filedata,size, &width, &height) == 0) {
 		zend_error(E_ERROR, "gd-webp cannot get webp info");
-		gdFree(temp);
+		gdFree(filedata);
 		return NULL;
 	}
 
 	im = gdImageCreateTrueColor(width, height);
 	if (!im) {
-		gdFree(temp);
+		gdFree(filedata);
 		return NULL;
 	}
 	argb = WebPDecodeARGB(filedata, size, &width, &height);
 	if (!argb) {
 		zend_error(E_ERROR, "gd-webp cannot allocate temporary buffer");
-		gdFree(temp);
+		gdFree(filedata);
 		gdImageDestroy(im);
 		return NULL;
 	}
@@ -94,7 +95,6 @@ gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
 	gdFree(filedata);
 	/* do not use gdFree here, in case gdFree/alloc is mapped to something else than libc */
 	free(argb);
-	gdFree(temp);
 	im->saveAlphaFlag = 1;
 	return im;
 }