From 8a7d030af7a41589a2948d029658778b79c2a27b Mon Sep 17 00:00:00 2001 From: Chris Young Date: Tue, 22 Mar 2016 19:45:15 +0000 Subject: Ensure we don't access invalid pointers --- amiga/bitmap.c | 14 +++++++++++--- amiga/bitmap.h | 6 ++++-- 2 files changed, 15 insertions(+), 5 deletions(-) (limited to 'amiga') diff --git a/amiga/bitmap.c b/amiga/bitmap.c index cb30354a2..043710261 100644 --- a/amiga/bitmap.c +++ b/amiga/bitmap.c @@ -59,7 +59,7 @@ struct bitmap { PLANEPTR native_mask; Object *dto; struct nsurl *url; /* temporary storage space */ - const char *title; /* temporary storage space */ + char *title; /* temporary storage space */ ULONG *icondata; /* for appicons */ }; @@ -143,10 +143,16 @@ void amiga_bitmap_destroy(void *bitmap) if(bm->native_mask) FreeRaster(bm->native_mask, bm->width, bm->height); FreeVec(bm->pixdata); + + if(bm->url) nsurl_unref(bm->url); + if(bm->title) free(bm->title); + bm->pixdata = NULL; bm->nativebm = NULL; bm->native_mask = NULL; bm->dto = NULL; + bm->url = NULL; + bm->title = NULL; ami_misc_itempool_free(pool_bitmap, bm, sizeof(struct bitmap)); bm = NULL; @@ -644,12 +650,14 @@ static nserror bitmap_render(struct bitmap *bitmap, hlcache_handle *content) void ami_bitmap_set_url(struct bitmap *bm, struct nsurl *url) { - bm->url = url; + if(bm->url != NULL) return; + bm->url = nsurl_ref(url); } void ami_bitmap_set_title(struct bitmap *bm, const char *title) { - bm->title = title; + if(bm->title != NULL) return; + bm->title = strdup(title); } ULONG *ami_bitmap_get_icondata(struct bitmap *bm) diff --git a/amiga/bitmap.h b/amiga/bitmap.h index a1893b317..743cd8faa 100755 --- a/amiga/bitmap.h +++ b/amiga/bitmap.h @@ -46,7 +46,8 @@ struct bitmap *ami_bitmap_from_datatype(char *filename); * \param bm a bitmap, as returned by bitmap_create() * \param title a pointer to a title string * - * It is assumed that this is freed elsewhere after the bitmap is destroyed. + * A reference will be kept by the bitmap object. + * The URL can only ever be set once for a bitmap. */ void ami_bitmap_set_url(struct bitmap *bm, struct nsurl *url); @@ -56,7 +57,8 @@ void ami_bitmap_set_url(struct bitmap *bm, struct nsurl *url); * \param bm a bitmap, as returned by bitmap_create() * \param title a pointer to a title string * - * It is assumed that this is freed elsewhere after the bitmap is destroyed. + * This is copied by the bitmap object. + * The title can only ever be set once for a bitmap. */ void ami_bitmap_set_title(struct bitmap *bm, const char *title); -- cgit v1.2.3