Prevent longjmp misuse

docs/changelog.md

@@ -9,6 +9,7 @@ Note: releases are listed from latest to oldest.
   reduction occured at the same time
 - Fixed a file descriptor leak that would keep an open `FILE *` if a `PLUM_ERR_FILE_ERROR` error was raised while
   reading from a file
+- Added safeguards to prevent internal `longjmp` misuse when generating image files
 - Ensured that the `PLUM_FILENAME`, `PLUM_BUFFER` and `PLUM_CALLBACK` constants are always `size_t` as documented
 - Enforced the size limitation on the value returned by a callback when using the `PLUM_CALLBACK` loading/storing mode
 - Handled out-of-palette background colors when generating a GIF file, ensuring that they would never cause the

src/store.c

@@ -6,7 +6,6 @@ size_t plum_store_image (const struct plum_image * image, void * restrict buffer
     if (error) *error = PLUM_ERR_OUT_OF_MEMORY;
     return 0;
   }
-  size_t result = 0;
   context -> source = image;
   if (setjmp(context -> target)) goto done;
   if (!(image && buffer && size)) throw(context, PLUM_ERR_INVALID_ARGUMENTS);
@@ -39,10 +38,11 @@ size_t plum_store_image (const struct plum_image * image, void * restrict buffer
       if (output_size > size) throw(context, PLUM_ERR_IMAGE_TOO_LARGE);
       write_generated_image_data(buffer, context -> output);
   }
-  result = output_size;
+  context -> size = output_size;
   done:
   if (context -> file) fclose(context -> file);
   if (error) *error = context -> status;
+  size_t result = context -> size;
   destroy_allocator_list(context -> allocator);
   return result;
 }