[pdf-devel] Memory management in pdf_fp_func_destroy

[Johannes Tax]

Hello,

when I tried to call pdf_fp_func_destroy in any of the test functions I
get a crash. The reason is that when a type 4 function is created the 
pointers passed for domain and range are used internally like follows:

pdf_status_t
pdf_fp_func_4_new (pdf_u32_t m,
                   pdf_u32_t n,
                   pdf_real_t domain[],
                   pdf_real_t range[],
                   pdf_char_t *code,
                   pdf_size_t code_size,
                   pdf_size_t *error_at,
                   pdf_fp_func_t *function)
{
[...]
  f->range = range;
  f->domain = domain;
[...]

However when destroying the function object pdf_dealloc is called on
those values:

pdf_fp_func_destroy (pdf_fp_func_t t)
{
[...]
  pdf_dealloc (t->domain);
  pdf_dealloc (t->range);
[...]

I think pdf_fp_func_destroy should not free memory that has not been 
allocated by pdf_fp_func[0-4]_new. A safe solution would be to 
(pdf_)allocate the needed storage for f->range and f->domain on calling
pdf_fp_func[0-4]_new. The included patch applies this solution and also
includes a test to exercise the pdf_fp_func_destroy function.

Or maybe I missed the intention behind the current design?

Johannes

--
Johannes Tax
address@hidden

pdf-fp-patch
Description: Text document