Avoid crashes on MS-Windows when JPEG images are too large.

 src/image.c (x_create_x_image_and_pixmap) [HAVE_NTGUI]: If
 CreateDIBSection returns an error indication, zero out *ximg after
 destroying the image.  This avoids crashes in memory allocations
 due to the fact that some of the callers also call
 x_destroy_x_image, which will attempt to free an already free'd
 block of memory.

diff --git a/src/ChangeLog b/src/ChangeLog
index 0fc12fce809aeff3305fdce1dec43a6218072597..cbc48a754690799ce782ba482ca22ccddc60669d 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,12 @@
+2014-02-19  Eli Zaretskii  <eliz@gnu.org>
+
+       * image.c (x_create_x_image_and_pixmap) [HAVE_NTGUI]: If
+       CreateDIBSection returns an error indication, zero out *ximg after
+       destroying the image.  This avoids crashes in memory allocations
+       due to the fact that some of the callers also call
+       x_destroy_x_image, which will attempt to free an already free'd
+       block of memory.
+
 2014-02-18  Martin Rudalics  <rudalics@gmx.at>
 
        * widget.c (update_various_frame_slots): Don't set

diff --git a/src/image.c b/src/image.c
index e53ad0b4a30a19b89be2d36bf41e5b164cd161cf..d6d5ace509ddb61cf0cec972d8bab216b6617db8 100644 (file)
--- a/src/image.c
+++ b/src/image.c
@@ -2019,6 +2019,7 @@ x_create_x_image_and_pixmap (struct frame *f, int width, int height, int depth,
       XSETINT (errcode, err);
       image_error ("Unable to create bitmap, error code %d", errcode, Qnil);
       x_destroy_x_image (*ximg);
+      *ximg = NULL;
       return 0;
     }