From 03352b04c579d15b65c6a7cc1ed3648c8911a1bd Mon Sep 17 00:00:00 2001
From: Janus <janus2@ymail.com>
Date: Fri, 30 Nov 2012 22:21:33 +0000
Subject: [PATCH] Fix #7736. Avoid memory corruption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Axel Dörfler <axeld@pinc-software.de>
---
 src/apps/showimage/ShowImageView.cpp | 11 +++++++----
 src/apps/showimage/ShowImageView.h   |  3 ++-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/apps/showimage/ShowImageView.cpp b/src/apps/showimage/ShowImageView.cpp
index e6d9a70ace..d82d3c89f1 100644
--- a/src/apps/showimage/ShowImageView.cpp
+++ b/src/apps/showimage/ShowImageView.cpp
@@ -347,12 +347,13 @@ ShowImageView::SetImage(const BMessage* message)
 		|| message->FindRef("ref", &ref) != B_OK || bitmap == NULL)
 		return B_ERROR;
 
-	status_t status = SetImage(&ref, bitmap);
+	BitmapOwner* bitmapOwner;
+	message->FindPointer("bitmapOwner", (void**)&bitmapOwner);
+
+	status_t status = SetImage(&ref, bitmap, bitmapOwner);
 	if (status == B_OK) {
 		fFormatDescription = message->FindString("type");
 		fMimeType = message->FindString("mime");
-
-		message->FindPointer("bitmapOwner", (void**)&fBitmapOwner);
 	}
 
 	return status;
@@ -360,7 +361,8 @@ ShowImageView::SetImage(const BMessage* message)
 
 
 status_t
-ShowImageView::SetImage(const entry_ref* ref, BBitmap* bitmap)
+ShowImageView::SetImage(const entry_ref* ref, BBitmap* bitmap,
+		BitmapOwner* bitmapOwner)
 {
 	// Delete the old one, and clear everything
 	fUndo.Clear();
@@ -369,6 +371,7 @@ ShowImageView::SetImage(const entry_ref* ref, BBitmap* bitmap)
 	_DeleteBitmap();
 
 	fBitmap = bitmap;
+	fBitmapOwner = bitmapOwner;
 	if (ref == NULL)
 		fCurrentRef.device = -1;
 	else
diff --git a/src/apps/showimage/ShowImageView.h b/src/apps/showimage/ShowImageView.h
index b14985b028..bdf4d106f6 100644
--- a/src/apps/showimage/ShowImageView.h
+++ b/src/apps/showimage/ShowImageView.h
@@ -52,7 +52,8 @@ public:
 			void				SetTrackerMessenger(
 									const BMessenger& trackerMessenger);
 			status_t			SetImage(const BMessage* message);
-			status_t			SetImage(const entry_ref* ref, BBitmap* bitmap);
+			status_t			SetImage(const entry_ref* ref, BBitmap* bitmap,
+									BitmapOwner* bitmapOwner);
 			const entry_ref*	Image() const { return &fCurrentRef; }
 			BBitmap*			Bitmap();