Fix NULL pointer dereferences in xpm_load_image

* src/image.c (x_destroy_x_image): Correct test condition.
(xpm_load_image): Do not release image data if it is still to be
created.

(cherry picked from commit b5543c54bf08c4fa4cae6b7f404a37a2aee60cdf)

diff --git a/src/image.c b/src/image.c
index 94404c098950c6d4a69692e832c65d6852126626..70ec1b316ee09a9fb0f403b147736b40b89f0558 100644 (file)
--- a/src/image.c
+++ b/src/image.c
@@ -3887,7 +3887,7 @@ x_create_x_image_and_pixmap (struct frame *f, int width, int height, int depth,
 static void
 x_destroy_x_image (XImage *ximg)
 {
-  if (ximg)
+  if (ximg->data)
     {
       xfree (ximg->data);
       ximg->data = NULL;
@@ -6502,9 +6502,12 @@ xpm_load_image (struct frame *f,
 
  failure:
   image_error ("Invalid XPM3 file (%s)", img->spec);
-  image_destroy_x_image (ximg);
-  image_destroy_x_image (mask_img);
-  image_clear_image (f, img);
+  if (ximg)
+    {
+      image_destroy_x_image (ximg);
+      image_destroy_x_image (mask_img);
+      image_clear_image (f, img);
+    }
   return 0;
 
 #undef match