Fix memory leak in corrupt JPEG decoding.

base/gfx/jpeg_codec.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/gfx/jpeg_codec.h"
 
 #include <setjmp.h>
 
 #include "base/logging.h"
 #include "base/scoped_ptr.h"
@@ skipping 166 matching lines @@
   jpeg_compress_struct* cinfo_;
 };
 
 }  // namespace
 
 bool JPEGCodec::Encode(const unsigned char* input, ColorFormat format,
                        int w, int h, int row_byte_width,
                        int quality, std::vector<unsigned char>* output) {
   jpeg_compress_struct cinfo;
   CompressDestroyer destroyer;
+  destroyer.SetManagedObject(&cinfo);
   output->clear();
 
   // We set up the normal JPEG error routines, then override error_exit.
   // This must be done before the call to create_compress.
   CoderErrorMgr errmgr;
   cinfo.err = jpeg_std_error(&errmgr.pub);
   errmgr.pub.error_exit = ErrorExit;
   // Establish the setjmp return context for ErrorExit to use.
   if (setjmp(errmgr.setjmp_buffer)) {
     // If we get here, the JPEG code has signaled an error.
     // MSDN notes: "if you intend your code to be portable, do not rely on
     // correct destruction of frame-based objects when executing a nonlocal
     // goto using a call to longjmp."  So we delete the CompressDestroyer's
     // object manually instead.
     destroyer.DestroyManagedObject();
     return false;
   }
 
   // The destroyer will destroy() cinfo on exit.
   jpeg_create_compress(&cinfo);
-  destroyer.SetManagedObject(&cinfo);
 
   cinfo.image_width = w;
   cinfo.image_height = h;
   cinfo.input_components = 3;
   cinfo.in_color_space = JCS_RGB;
   cinfo.data_precision = 8;
 
   jpeg_set_defaults(&cinfo);
   jpeg_set_quality(&cinfo, quality, 1);  // quality here is 0-100
 
@@ skipping 170 matching lines @@
   jpeg_decompress_struct* cinfo_;
 };
 
 }  // namespace
 
 bool JPEGCodec::Decode(const unsigned char* input, size_t input_size,
                        ColorFormat format, std::vector<unsigned char>* output,
                        int* w, int* h) {
   jpeg_decompress_struct cinfo;
   DecompressDestroyer destroyer;
+  destroyer.SetManagedObject(&cinfo);
   output->clear();
 
   // We set up the normal JPEG error routines, then override error_exit.
   // This must be done before the call to create_decompress.
   CoderErrorMgr errmgr;
   cinfo.err = jpeg_std_error(&errmgr.pub);
   errmgr.pub.error_exit = ErrorExit;
   // Establish the setjmp return context for ErrorExit to use.
   if (setjmp(errmgr.setjmp_buffer)) {
     // If we get here, the JPEG code has signaled an error.
     // See note in JPEGCodec::Encode() for why we need to destroy the cinfo
     // manually here.
     destroyer.DestroyManagedObject();
     return false;
   }
 
   // The destroyer will destroy() cinfo on exit.  We don't want to set the
   // destroyer's object until cinfo is initialized.
   jpeg_create_decompress(&cinfo);
-  destroyer.SetManagedObject(&cinfo);
 
   // set up the source manager
   jpeg_source_mgr srcmgr;
   srcmgr.init_source = InitSource;
   srcmgr.fill_input_buffer = FillInputBuffer;
   srcmgr.skip_input_data = SkipInputData;
   srcmgr.resync_to_restart = jpeg_resync_to_restart;  // use default routine
   srcmgr.term_source = TermSource;
   cinfo.src = &srcmgr;
 
@@ skipping 86 matching lines @@
   // Skia only handles 32 bit images.
   int data_length = w * h * 4;
 
   SkBitmap* bitmap = new SkBitmap();
   bitmap->setConfig(SkBitmap::kARGB_8888_Config, w, h);
   bitmap->allocPixels();
   memcpy(bitmap->getAddr32(0, 0), &data_vector[0], data_length);
 
   return bitmap;
 }