Commit b77e37b5 for tesseract
commit b77e37b5fcbb223cdbae4a46598b9f0b672adfb5
Author: Stefan Weil <sw@weilnetz.de>
Date: Sun Aug 9 14:53:42 2026 +0200
Fix CID 1487960 (Double free)
In ReTypeBlobs, a zero area blob was deleted while it was still
linked in the partition's box list. The list destructor then
deleted the dangling link again. Remove the blob from the list
and detach its cblob before deleting it.
Assisted-by: OpenCode / big-pickle (opencode)
Signed-off-by: Stefan Weil <sw@weilnetz.de>
diff --git a/src/textord/colpartitiongrid.cpp b/src/textord/colpartitiongrid.cpp
index 40462d6c..48cbf72c 100644
--- a/src/textord/colpartitiongrid.cpp
+++ b/src/textord/colpartitiongrid.cpp
@@ -942,7 +942,9 @@ void ColPartitionGrid::ReTypeBlobs(BLOBNBOX_LIST *im_blobs) {
BLOBNBOX *blob = blob_it.data();
if (blob->cblob()->area() == 0) {
// Any blob with zero area is a fake image blob and should be deleted.
- delete blob->cblob();
+ // Remove it from the list first to avoid a double delete.
+ delete blob->remove_cblob();
+ blob_it.extract();
delete blob;
}
}