direct leak in qcms_transform_precacheLUT_float

RESOLVED FIXED in Firefox 60

Status

()

P3
normal
RESOLVED FIXED
11 months ago
10 months ago

People

(Reporter: pdknsk, Assigned: lsalzman)

Tracking

Trunk
mozilla60
Points:
---

Firefox Tracking Flags

(firefox60 fixed)

Details

(Whiteboard: [gfx-noted])

Attachments

(1 attachment)

(Reporter)

Description

11 months ago
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.98 Safari/537.36

Steps to reproduce:

==7745==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 431244 byte(s) in 1 object(s) allocated from:
    ...
    #1 0x521079 in qcms_transform_precacheLUT_float transform.c:1162:8

https://dxr.mozilla.org/mozilla-central/rev/e4107773cffb1baefd5446666fce22c4d6eb0517/gfx/qcms/transform.c#1162

The problem is that src becomes lut later.

https://dxr.mozilla.org/mozilla-central/rev/e4107773cffb1baefd5446666fce22c4d6eb0517/gfx/qcms/transform.c#1178

I made a simple patch.

--- a/qcms/transform.c
+++ b/qcms/transform.c
@@ -995,6 +995,10 @@
 	free(t->output_gamma_lut_g);
 	free(t->output_gamma_lut_b);
 
+	/* src in qcms_chain_transform */
+	if (t->r_clut)
+		free(t->r_clut);
+
 	transform_free(t);
 }
(Reporter)

Comment 1

11 months ago
Correction.

+	/* src or dest in qcms_chain_transform */

Updated

11 months ago
Component: Untriaged → Graphics
Product: Firefox → Core

Updated

11 months ago
Priority: -- → P3
Whiteboard: [gfx-noted]
(Assignee)

Comment 2

10 months ago
Created attachment 8949235 [details] [diff] [review]
free qcms_transform r_clut

pdknsk, your analysis of the situation seems correct. I've rolled this into a patch. The comments have been elaborated a bit, but otherwise the semantics of the patch are the same and sufficient.
Assignee: nobody → lsalzman
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Attachment #8949235 - Flags: review?(jmuizelaar)
Attachment #8949235 - Flags: review?(jmuizelaar) → review+

Comment 3

10 months ago
Pushed by lsalzman@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/73255f988eb1
free qcms_transform r_clut. r=jrmuizel

Comment 4

10 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/73255f988eb1
Status: ASSIGNED → RESOLVED
Last Resolved: 10 months ago
status-firefox60: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
You need to log in before you can comment on or make changes to this bug.