[gimp/wip/Jehan/Issue-6610] Issue #6610: crashes on free select for images of certain dimensions.

[Jehan <jehanp src gnome org>]

commit 63aaa0fa2415cb829048e10f4a88ff218f45a498
Author: Jehan <jehan girinstud io>
Date:   Wed Aug 4 00:29:56 2021 +0200

    Issue #6610: crashes on free select for images of certain dimensions.
    
    g_alloca() is unadvised. Even though it might be more efficient in some
    specific cases, it is pretty subject to stack overflow when a lot of
    memory is requested.
    
    Let's allocate dynamic memory instead. To avoid doing it too much, let's
    just reuse the same pointer especially since region of interest will
    usually be the same size when iterating a buffer, except for border
    ones (which would usually be smaller, so we can use the same allocated
    buffer again). I still make size checks, just in case.

 app/core/gimpscanconvert.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)
---
diff --git a/app/core/gimpscanconvert.c b/app/core/gimpscanconvert.c
index 3aaedf4700..2235080b9a 100644
--- a/app/core/gimpscanconvert.c
+++ b/app/core/gimpscanconvert.c
@@ -497,6 +497,8 @@ gimp_scan_convert_render_full (GimpScanConvert *sc,
                                gdouble          value)
 {
   const Babl         *format;
+  guchar             *shared_buf      = NULL;
+  gsize               shared_buf_size = 0;
   GeglBufferIterator *iter;
   GeglRectangle      *roi;
   cairo_t            *cr;
@@ -545,7 +547,13 @@ gimp_scan_convert_render_full (GimpScanConvert *sc,
        */
       if (roi->width * bpp != stride)
         {
-          tmp_buf = g_alloca (stride * roi->height);
+          if (shared_buf_size < stride * roi->height)
+            {
+              shared_buf_size = stride * roi->height;
+              g_free (shared_buf);
+              shared_buf = g_malloc (shared_buf_size);
+            }
+          tmp_buf = shared_buf;
 
           if (! replace)
             {
@@ -634,4 +642,6 @@ gimp_scan_convert_render_full (GimpScanConvert *sc,
             }
         }
     }
+
+  g_free (shared_buf);
 }