Fix a crash in exif processing
Given a zero length string, the pointer was left unset, but later code checked if the value of the pointer was non-null, and ignored the length.
Esse commit está contido em:
@@ -6016,6 +6016,7 @@ static int exif_process_string_raw(char **result, char *value,
|
||||
* chars up to byte_count, we also have to add a single NUL character to
|
||||
* force end of string.
|
||||
*/
|
||||
*result = 0;
|
||||
if (byte_count) {
|
||||
(*result) = (char*)IM_MALLOC(byte_count + 1);
|
||||
CHECK_ALLOC_R((*result), byte_count + 1, 0);
|
||||
|
||||
Referência em uma Nova Issue
Bloquear um usuário