Merge pull request #5909 from radarhere/transform

Fixed freeing pointer in ImageDraw.Outline.transform
python-pillow · Dec 27, 2021 · 7adab8f · 7adab8f
2 parents 11c536b + 4222605
commit 7adab8f
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 7 deletions.
diff --git a/Tests/test_imagedraw.py b/Tests/test_imagedraw.py
@@ -467,6 +467,23 @@ def test_shape2():
     assert_image_equal_tofile(im, "Tests/images/imagedraw_shape2.png")
 
 
+def test_transform():
+    # Arrange
+    im = Image.new("RGB", (100, 100), "white")
+    expected = im.copy()
+    draw = ImageDraw.Draw(im)
+
+    # Act
+    s = ImageDraw.Outline()
+    s.line(0, 0)
+    s.transform((0, 0, 0, 0, 0, 0))
+
+    draw.shape(s, fill=1)
+
+    # Assert
+    assert_image_equal(im, expected)
+
+
 def helper_pieslice(bbox, start, end):
     # Arrange
     im = Image.new("RGB", (W, H))

diff --git a/src/libImaging/Draw.c b/src/libImaging/Draw.c
@@ -1854,14 +1854,8 @@ ImagingOutlineTransform(ImagingOutline outline, double a[6]) {
     eIn = outline->edges;
     n = outline->count;
 
-    /* FIXME: ugly! */
-    outline->edges = NULL;
-    outline->count = outline->size = 0;
-
     eOut = allocate(outline, n);
     if (!eOut) {
-        outline->edges = eIn;
-        outline->count = outline->size = n;
         ImagingError_MemoryError();
         return -1;
     }
@@ -1897,7 +1891,11 @@ ImagingOutlineTransform(ImagingOutline outline, double a[6]) {
         eOut++;
     }
 
-    free(eIn);
+    free(outline->edges);
+
+    /* FIXME: ugly! */
+    outline->edges = NULL;
+    outline->count = outline->size = 0;
 
     return 0;
 }