| commit | 5479d3b5690c274bb53c78333c7c4d41cd5f9137 | [log] [tgz] |
|---|---|---|
| author | fmalita <fmalita@chromium.org> | Wed Jul 29 14:40:06 2015 -0700 |
| committer | Commit bot <commit-bot@chromium.org> | Wed Jul 29 14:40:06 2015 -0700 |
| tree | dc3f6b23f68ce347a7289bc52f651a9bce9ab463 | |
| parent | 3ac6b7551dc7aa182018f96b32f6e516305333ee [diff] |
Double free in ~SkPictureData() On subpicture parsing failures we clean up all fPictureRefs entries *and* delete the array itself. But the destructor also deletes the array => double free. Alternatively, we can set fPictureCount to the number of successfully parsed pictures such that the destructor handles all the cleanup. BUG=515228 R=reed@google.com,mtklein@google.com Review URL: https://codereview.chromium.org/1264503011