commit c8dcd16b01ea0f5ac8f32ee18374b2ca2694dd6c
author Lucas Tanure <tanure@linux.com> Wed Sep 23 10:33:21 2015 -0300
committer Bryce Harrington <bryce@osg.samsung.com> Wed Sep 23 17:02:28 2015 -0700
tree f0d00b5f7b1fd2e68844072ccb386a915aca3aad
parent ae5df83f8e029e427f5d587622b3d25b3d1b4964

ivi-layout-transition: Fix potential leak of memory pointed to by transition

Several fixes to handle invalid transition objects:

1. Free transition in ivi_layout_transition_fade_layer if we fail to
   allocate memory for data

2. Check if transition is not null and if layout_transition_register was
   ok before return, if not, free transition

3. Destroy transition if layout_transition_register was not ok, we can't
   just free transition, we need to call layout_transition_destroy in
   order to free private_data from transition

Signed-off-by: Lucas Tanure <tanure@linux.com>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>

ivi-shell/ivi-layout-transition.c

diff --git a/ivi-shell/ivi-layout-transition.c b/ivi-shell/ivi-layout-transition.c
index 150e301..adaa543 100644
--- a/ivi-shell/ivi-layout-transition.c
+++ b/ivi-shell/ivi-layout-transition.c
@@ -512,7 +512,7 @@
 		destroy_func,
 		duration);
 
-	if(!layout_transition_register(transition))
+	if (!layout_transition_register(transition))
 		layout_transition_destroy(transition);
 }
 
@@ -746,9 +746,10 @@
 		NULL, NULL,
 		duration);
 
-	layout_transition_register(transition);
+	if (transition && layout_transition_register(transition))
+		return;
 
-	return;
+	free(transition);
 }
 
 void
@@ -850,6 +851,7 @@
 	data = malloc(sizeof(*data));
 	if (data == NULL) {
 		weston_log("%s: memory allocation fails\n", __func__);
+		free(transition);
 		return;
 	}
 
@@ -871,7 +873,8 @@
 	data->end_alpha = end_alpha;
 	data->destroy_func = destroy_func;
 
-	layout_transition_register(transition);
+	if (!layout_transition_register(transition))
+		layout_transition_destroy(transition);
 
 	return;
 }