From: Michael Orlitzky <michael@orlitzky.com>
Date: Sat, 19 Oct 2024 20:46:51 +0000 (-0400)
Subject: src/svgtiny_css.c free dom_string in svgtiny_dom_user_data_handler()
X-Git-Url: https://gitweb.michael.orlitzky.com/?a=commitdiff_plain;h=43eb9a343bdf3f8330d03eab12fd0ba17abea1f0;p=libsvgtiny.git

src/svgtiny_css.c free dom_string in svgtiny_dom_user_data_handler()

This callback uses dom_string_create() for a comparison, but forgets
to call either dom_string_destroy() or dom_string_unref() after the
string has outlived its usefulness. The string is used one line after
it is created, so we find dom_string_destroy() to be more clear in
this case.
---

diff --git a/src/svgtiny_css.c b/src/svgtiny_css.c
index 96991dd..bbef58d 100644
--- a/src/svgtiny_css.c
+++ b/src/svgtiny_css.c
@@ -1938,8 +1938,10 @@ static void svgtiny_dom_user_data_handler(dom_node_operation operation,
 	dom_string_create((const uint8_t *)"_libcss_user_data", 17, &str);
 	if (dom_string_isequal(str,key) == false || data == NULL) {
 		/* Wrong key, or no data */
+		dom_string_destroy(str);
 		return;
 	}
+	dom_string_destroy(str);
 
 	/* Check the DOM operation, and make the corresponding call to
 	 * css_libcss_node_data_handler(). No error handling is done.