From 83e4402e905183dfebadded26b33845557e34dc1 Mon Sep 17 00:00:00 2001
From: Philip Rideout <philiprideout@gmail.com>
Date: Thu, 25 Oct 2018 13:42:21 -0700
Subject: [PATCH] JS: fix use-before-free for PNG data.

---
 libs/filamentjs/jsbindings.cpp | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/libs/filamentjs/jsbindings.cpp b/libs/filamentjs/jsbindings.cpp
index 33ede523fb..c1ad3d23a0 100644
--- a/libs/filamentjs/jsbindings.cpp
+++ b/libs/filamentjs/jsbindings.cpp
@@ -172,11 +172,6 @@ struct DecodedPng {
     int encoded_ncomp;
     int decoded_ncomp;
     BufferDescriptor decoded_data;
-    ~DecodedPng() {
-      if (decoded_data.bd) {
-        stbi_image_free(decoded_data.bd->buffer);
-      }
-    }
 };
 
 // JavaScript clients should call [createTextureFromPng] rather than calling this directly.
@@ -191,6 +186,9 @@ DecodedPng decodePng(BufferDescriptor encoded_data, int requested_ncomp) {
             requested_ncomp);
     const uint32_t decoded_size = result.width * result.height * requested_ncomp;
     result.decoded_data = BufferDescriptor(decoded_data, decoded_size);
+    result.decoded_data.bd->setCallback([](void* buffer, size_t size, void* user) {
+        stbi_image_free(buffer);
+    });
     result.decoded_ncomp = requested_ncomp;
     return result;
 }