The svgtiny_parse() function has a "cleanup:" label at the end
that... cleans up, and then returns whatever result is set. Looking
back through this function, though, we see that none of "svg",
"document", or "state.select_ctx" are cleaned up separately in the two
places where we jump to the "cleanup:" label. Thus those resources may
be leaked.
To prevent that, we just have to move the "cleanup:" label up a bit,
so that it includes the clean-up for "svg", "document", and
"state.select_ctx". We also add a new guard that prevents us from
clobbering a real error code with an error from the context destructor
in the cleanup routine.
code = svgtiny_parse_svg(svg, state);
}
+cleanup:
dom_node_unref(svg);
dom_node_unref(document);
+
+ /* Only override the true exit code with a failure from this
+ * "destroy" if a more meaningful error code is not already
+ * set. */
css_code = css_select_ctx_destroy(state.select_ctx);
- if (css_code != CSS_OK) {
+ if (css_code != CSS_OK && code == svgtiny_OK) {
code = svgtiny_LIBCSS_ERROR;
}
-cleanup:
svgtiny_cleanup_state_local(&state);
#define SVGTINY_STRING_ACTION2(s,n) \
if (state.interned_##s != NULL) \