sixel_encoder_prepare_palette: kill use-after-free

dankamongmen · dankamongmen · commit d299d67c532a · 2021-09-18T00:27:34.000-04:00
The only place sixel_encoder_prepare_palette() is called from is sixel_encoder_encode_frame(). If we have a SIXEL_FAILED result inside the former, we unref the palette, potentially freeing it. We then goto the error path for sixel_encoder_encode_frame(), where we unref it again, in a classic double-free. Remove the internal unref. As noted, this is a single call site, so removing the unref can't cause a memory leak. Closes #27, reported by a4865g ("WuLearn").
diff --git a/src/encoder.c b/src/encoder.c
@@ -560,7 +560,6 @@ sixel_encoder_prepare_palette(
                                      encoder->method_for_rep,
                                      encoder->quality_mode);
     if (SIXEL_FAILED(status)) {
-        sixel_dither_unref(*dither);
         goto end;
     }
 

Original file line number	Diff line number	Diff line change
`@@ -560,7 +560,6 @@ sixel_encoder_prepare_palette(`
`560`	`560`	`encoder->method_for_rep,`
`561`	`561`	`encoder->quality_mode);`
`562`	`562`	`if (SIXEL_FAILED(status)) {`
`563`		`- sixel_dither_unref(*dither);`
`564`	`563`	`goto end;`
`565`	`564`	`}`
`566`	`565`