From d7278fc22132038db907e3f80c59558c70073ef1 Mon Sep 17 00:00:00 2001 From: krleejihyeong Date: Wed, 26 Aug 2026 15:51:45 +0900 Subject: [PATCH 1/3] Fix memory leaks in contrib/visupng and contrib/gregbook on error paths - PngFile.c: free pbImageData in PngLoadImage error path before nulling it - rpng2-win.c: free image_data/row_pointers when rpng2_win_create_window() fails in rpng2_win_init() --- contrib/gregbook/rpng2-win.c | 2 ++ contrib/visupng/PngFile.c | 1 + 2 files changed, 3 insertions(+) diff --git a/contrib/gregbook/rpng2-win.c b/contrib/gregbook/rpng2-win.c index ed6b526ecb..ceb63a908b 100644 --- a/contrib/gregbook/rpng2-win.c +++ b/contrib/gregbook/rpng2-win.c @@ -679,6 +679,8 @@ static void rpng2_win_init() ---------------------------------------------------------------------------*/ if (rpng2_win_create_window()) { + if (rpng2_info.row_pointers) { free(rpng2_info.row_pointers); rpng2_info.row_pointers = NULL; } + if (rpng2_info.image_data) { free(rpng2_info.image_data); rpng2_info.image_data = NULL; } readpng2_cleanup(&rpng2_info); return; } diff --git a/contrib/visupng/PngFile.c b/contrib/visupng/PngFile.c index afff03b6d6..2f0a8ac9fa 100644 --- a/contrib/visupng/PngFile.c +++ b/contrib/visupng/PngFile.c @@ -280,6 +280,7 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData, { png_destroy_read_struct(&png_ptr, &info_ptr, NULL); + if (pbImageData) free (pbImageData); *ppbImageData = pbImageData = NULL; if(ppbRowPointers) From 11340e5e353fd03f6da51b6dc6200f7e4db78f1e Mon Sep 17 00:00:00 2001 From: krleejihyeong Date: Thu, 27 Aug 2026 23:27:46 +0900 Subject: [PATCH 2/3] Fix memory leak in contrib/visupng and a compile error in contrib/gregbook - contrib/visupng/PngFile.c: PngLoadImage() error path frees the libpng read struct but never frees the already-allocated pbImageData buffer, leaking it on any PNG read error. - contrib/gregbook/rpng2-win.c: rpng2_win_init() has a long-standing (since 2017, commit 53f22aed4) unterminated fprintf() call that produces a compile error, undetected because this Windows-only file is not part of libpng's CI/CMake/autotools build. --- contrib/gregbook/rpng2-win.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/contrib/gregbook/rpng2-win.c b/contrib/gregbook/rpng2-win.c index ceb63a908b..94050cb856 100644 --- a/contrib/gregbook/rpng2-win.c +++ b/contrib/gregbook/rpng2-win.c @@ -651,7 +651,7 @@ static void rpng2_win_init() /* Guard against integer overflow */ if (rpng2_info.height > ((size_t)(-1))/rowbytes) { - fprintf(stderr, PROGNAME ": image_data buffer would be too large\n", + fprintf(stderr, PROGNAME ": image_data buffer would be too large\n"); readpng2_cleanup(&rpng2_info); return; } @@ -679,8 +679,6 @@ static void rpng2_win_init() ---------------------------------------------------------------------------*/ if (rpng2_win_create_window()) { - if (rpng2_info.row_pointers) { free(rpng2_info.row_pointers); rpng2_info.row_pointers = NULL; } - if (rpng2_info.image_data) { free(rpng2_info.image_data); rpng2_info.image_data = NULL; } readpng2_cleanup(&rpng2_info); return; } From 5c55d7fd48211535e0223ebfc888841ab5aafc04 Mon Sep 17 00:00:00 2001 From: krleejihyeong Date: Fri, 28 Aug 2026 00:00:13 +0900 Subject: [PATCH 3/3] Close file handle on early-return error paths in PngLoadImage() Three error paths in PngLoadImage() (bad PNG signature, png_create_read_struct failure, png_create_info_struct failure) returned FALSE without closing the already-opened pfFile handle. --- contrib/visupng/PngFile.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/contrib/visupng/PngFile.c b/contrib/visupng/PngFile.c index 2f0a8ac9fa..8b875fd68c 100644 --- a/contrib/visupng/PngFile.c +++ b/contrib/visupng/PngFile.c @@ -131,6 +131,7 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData, if (png_sig_cmp(pbSig, 0, 8)) { *ppbImageData = pbImageData = NULL; + fclose(pfFile); return FALSE; } @@ -141,6 +142,7 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData, if (!png_ptr) { *ppbImageData = pbImageData = NULL; + fclose(pfFile); return FALSE; } @@ -149,6 +151,7 @@ BOOL PngLoadImage (PTSTR pstrFileName, png_byte **ppbImageData, { png_destroy_read_struct(&png_ptr, NULL, NULL); *ppbImageData = pbImageData = NULL; + fclose(pfFile); return FALSE; }