From ba2fdf5517af3bcd8a613fda84c532307d1e7024 Mon Sep 17 00:00:00 2001
From: Robin Watts <Robin.Watts@artifex.com>
Date: Fri, 29 May 2020 17:22:40 +0100
Subject: [PATCH] Fix memory leaks in tiffsep.

Calling TIFFCleanup doesn't close the underlying tiffio. Call
TIFFClose instead.

Now the tiff io close handler is actually called, be careful
not to close the underlying file twice.

Finally, actually remember to close the comp file.
---
 base/gstiffio.c    | 20 +++++++++++---------
 devices/gdevtifs.c |  2 +-
 devices/gdevtsep.c |  8 +++-----
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/base/gstiffio.c b/base/gstiffio.c
index ff67dc5e5..2ea8c54bd 100644
--- a/base/gstiffio.c
+++ b/base/gstiffio.c
@@ -105,11 +105,13 @@ gs_tifsCloseProc(thandle_t fd)
 {
     tifs_io_private *tiffio = (tifs_io_private *)fd;
     gx_device_printer *pdev = tiffio->pdev;
-    int code = gp_fclose(tiffio->f);
-    
+
+    /* We don't close tiffio->f as this will be closed later by the
+     * device. */
+
     gs_free(pdev->memory, tiffio, sizeof(tifs_io_private), 1, "gs_tifsCloseProc");
 
-    return code;
+    return 0;
 }
 
 static uint64_t
@@ -122,12 +124,12 @@ gs_tifsSizeProc(thandle_t fd)
     if (curpos < 0) {
         return(0);
     }
-    
+
     if (gp_fseek(tiffio->f, (gs_offset_t)0, SEEK_END) < 0) {
         return(0);
     }
     length = (uint64_t)gp_ftell(tiffio->f);
-    
+
     if (gp_fseek(tiffio->f, curpos, SEEK_SET) < 0) {
         return(0);
     }
@@ -152,7 +154,7 @@ tiff_from_filep(gx_device_printer *dev,  const char *name, gp_file *filep, int b
         mode[modelen++] = '8';
 
     mode[modelen] = (char)0;
-    
+
     tiffio = (tifs_io_private *)gs_malloc(dev->memory, sizeof(tifs_io_private), 1, "tiff_from_filep");
     if (!tiffio) {
         return NULL;
@@ -173,7 +175,7 @@ static void
 gs_tifsWarningHandlerEx(thandle_t client_data, const char* module, const char* fmt, va_list ap)
 {
     tifs_io_private *tiffio = (tifs_io_private *)client_data;
-    gx_device_printer *pdev = tiffio->pdev;    
+    gx_device_printer *pdev = tiffio->pdev;
     int count;
     char buf[TIFF_PRINT_BUF_LENGTH];
 
@@ -190,7 +192,7 @@ static void
 gs_tifsErrorHandlerEx(thandle_t client_data, const char* module, const char* fmt, va_list ap)
 {
     tifs_io_private *tiffio = (tifs_io_private *)client_data;
-    gx_device_printer *pdev = tiffio->pdev;    
+    gx_device_printer *pdev = tiffio->pdev;
     const char *max_size_error = "Maximum TIFF file size exceeded";
     int count;
     char buf[TIFF_PRINT_BUF_LENGTH];
@@ -242,7 +244,7 @@ TIFFOpen(const char* name, const char* mode)
 {
     (void)name;
     (void)mode;
-    
+
     return(NULL);
 }
 
diff --git a/devices/gdevtifs.c b/devices/gdevtifs.c
index de30a934b..6b5ff41a4 100644
--- a/devices/gdevtifs.c
+++ b/devices/gdevtifs.c
@@ -74,7 +74,7 @@ tiff_close(gx_device * pdev)
     gx_device_tiff *const tfdev = (gx_device_tiff *)pdev;
 
     if (tfdev->tif)
-        TIFFCleanup(tfdev->tif);
+        TIFFClose(tfdev->tif);
 
     if (tfdev->icclink != NULL)
     {
diff --git a/devices/gdevtsep.c b/devices/gdevtsep.c
index 5142d0d0c..2b14c4e90 100644
--- a/devices/gdevtsep.c
+++ b/devices/gdevtsep.c
@@ -1813,7 +1813,7 @@ tiffsep_close_sep_file(tiffsep_device *tfdev, const char *fn, int comp_num)
     int code;
 
     if (tfdev->tiff[comp_num]) {
-        TIFFCleanup(tfdev->tiff[comp_num]);
+        TIFFClose(tfdev->tiff[comp_num]);
         tfdev->tiff[comp_num] = NULL;
     }
 
@@ -1832,7 +1832,7 @@ tiffsep_close_comp_file(tiffsep_device *tfdev, const char *fn)
     int code;
 
     if (tfdev->tiff_comp) {
-        TIFFCleanup(tfdev->tiff_comp);
+        TIFFClose(tfdev->tiff_comp);
         tfdev->tiff_comp = NULL;
     }
 
@@ -2577,9 +2577,7 @@ cleanup:
             }
         }
         TIFFWriteDirectory(tfdev->tiff_comp);
-        if (fmt) {
-            code = tiffsep_close_comp_file(tfdev, pdev->fname);
-        }
+        code = tiffsep_close_comp_file(tfdev, pdev->fname);
         if (code1 < 0) {
             code = code1;
         }
-- 
2.33.0