X-Git-Url: https://git.saurik.com/android/aapt.git/blobdiff_plain/e2d795d9f2b0baed768f23bce1944fdf52803331..c7f6ad837eb3f04dafbc96939d18fe90afd38dbf:/Images.cpp

diff --git a/Images.cpp b/Images.cpp
index 0a4c68b..3c471ca 100644
--- a/Images.cpp
+++ b/Images.cpp
@@ -44,6 +44,9 @@ struct image_info
             }
             free(allocRows);
         }
+        free(info9Patch.xDivs);
+        free(info9Patch.yDivs);
+        free(info9Patch.colors);
     }
 
     png_uint_32 width;
@@ -356,7 +359,7 @@ static status_t do_9patch(const char* imageName, image_info* image)
 
     const char* errorMsg = NULL;
     int errorPixel = -1;
-    const char* errorEdge = "";
+    const char* errorEdge = NULL;
 
     int colorIndex = 0;
 
@@ -460,6 +463,14 @@ static status_t do_9patch(const char* imageName, image_info* image)
     if (yDivs[numYDivs - 1] == H) {
         numRows--;
     }
+
+    // Make sure the amount of rows and columns will fit in the number of
+    // colors we can use in the 9-patch format.
+    if (numRows * numCols > 0x7F) {
+        errorMsg = "Too many rows and columns in 9-patch perimeter";
+        goto getout;
+    }
+
     numColors = numRows * numCols;
     image->info9Patch.numColors = numColors;
     image->info9Patch.colors = (uint32_t*)malloc(numColors * sizeof(uint32_t));
@@ -530,12 +541,14 @@ getout:
         fprintf(stderr,
             "ERROR: 9-patch image %s malformed.\n"
             "       %s.\n", imageName, errorMsg);
-        if (errorPixel >= 0) {
-            fprintf(stderr,
-            "       Found at pixel #%d along %s edge.\n", errorPixel, errorEdge);
-        } else {
-            fprintf(stderr,
-            "       Found along %s edge.\n", errorEdge);
+        if (errorEdge != NULL) {
+            if (errorPixel >= 0) {
+                fprintf(stderr,
+                    "       Found at pixel #%d along %s edge.\n", errorPixel, errorEdge);
+            } else {
+                fprintf(stderr,
+                    "       Found along %s edge.\n", errorEdge);
+            }
         }
         return UNKNOWN_ERROR;
     }
@@ -610,7 +623,7 @@ static void dump_image(int w, int h, png_bytepp rows, int color_type)
     } else if (color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
         bpp = 2;
     } else if (color_type == PNG_COLOR_TYPE_RGB || color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
-	    // We use a padding byte even when there is no alpha
+        // We use a padding byte even when there is no alpha
         bpp = 4;
     } else {
         printf("Unknown color type %d.\n", color_type);
@@ -833,6 +846,7 @@ static void write_png(const char* imageName,
     int i;
 
     png_unknown_chunk unknowns[1];
+    unknowns[0].data = NULL;
 
     png_bytepp outRows = (png_bytepp) malloc((int) imageInfo.height * png_sizeof(png_bytep));
     if (outRows == (png_bytepp) 0) {
@@ -939,6 +953,7 @@ static void write_png(const char* imageName,
         free(outRows[i]);
     }
     free(outRows);
+    free(unknowns[0].data);
 
     png_get_IHDR(write_ptr, write_info, &width, &height,
        &bit_depth, &color_type, &interlace_type,