From 2c89553437aee3ac9361cdc3a100908c285b6366 Mon Sep 17 00:00:00 2001
From: nick black <dankamongmen@gmail.com>
Date: Tue, 19 Oct 2021 20:23:22 -0400
Subject: [PATCH] [bitmaps] kill memory leak on resize failure path

---
 src/lib/internal.h | 17 +++++++++++------
 src/lib/kitty.c    | 10 ----------
 src/lib/visual.c   |  6 ++++++
 3 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/src/lib/internal.h b/src/lib/internal.h
index 8260ccbb7..61877dbd6 100644
--- a/src/lib/internal.h
+++ b/src/lib/internal.h
@@ -717,15 +717,20 @@ sprite_commit(tinfo* ti, fbuf* f, sprixel* s, unsigned forcescroll){
   return 0;
 }
 
+static inline void
+cleanup_tam(tament* tam, int ydim, int xdim){
+  for(int y = 0 ; y < ydim ; ++y){
+    for(int x = 0 ; x < xdim ; ++x){
+      free(tam[y * xdim + x].auxvector);
+      tam[y * xdim + x].auxvector = NULL;
+    }
+  }
+}
+
 static inline void
 destroy_tam(ncplane* p){
   if(p->tam){
-    for(int y = 0 ; y < p->leny ; ++y){
-      for(int x = 0 ; x < p->lenx ; ++x){
-        free(p->tam[y * p->lenx + x].auxvector);
-        p->tam[y * p->lenx + x].auxvector = NULL;
-      }
-    }
+    cleanup_tam(p->tam, p->leny, p->lenx);
     free(p->tam);
   }
 }
diff --git a/src/lib/kitty.c b/src/lib/kitty.c
index 9f0988e00..6e8afca83 100644
--- a/src/lib/kitty.c
+++ b/src/lib/kitty.c
@@ -547,16 +547,6 @@ int kitty_commit(fbuf* f, sprixel* s, unsigned noscroll){
   return 0;
 }
 
-static void
-cleanup_tam(tament* tam, int ydim, int xdim){
-  for(int y = 0 ; y < ydim ; ++y){
-    for(int x = 0 ; x < xdim ; ++x){
-      free(tam[y * xdim + x].auxvector);
-      tam[y * xdim + x].auxvector = NULL;
-    }
-  }
-}
-
 static inline void*
 zctx_origbuf(z_stream* zctx, int pixy, int pixx){
   size_t blen = pixx * pixy * 4;
diff --git a/src/lib/visual.c b/src/lib/visual.c
index c5a970247..c387d3adc 100644
--- a/src/lib/visual.c
+++ b/src/lib/visual.c
@@ -1125,6 +1125,12 @@ ncplane* ncvisual_render_pixels(notcurses* nc, ncvisual* ncv, const struct blits
 //fprintf(stderr, "ABOUT TO RESIZE: yoff/xoff: %d/%d\n",  placey, placex);
   // FIXME might need shrink down the TAM and kill unnecessary auxvecs
   if(ncplane_resize(n, 0, 0, s->dimy, s->dimx, placey, placex, s->dimy, s->dimx)){
+    // if we blow up here, then we've got a TAM sized to the sprixel, rather
+    // than the plane. running it through destroy_tam() via ncplane_destroy()
+    // will use incorrect bounds for scrubbing said TAM. do it manually here.
+    cleanup_tam(n->tam, rows, cols);
+    free(n->tam);
+    n->tam = NULL;
     sprixel_hide(bargs.u.pixel.spx);
     ncplane_destroy(createdn);
     return NULL;