ReFuel/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* src/type1/t1load.c (parse_subrs): Fix memory leak.

Browse Source 
The `subrs' keyword might erroneously occur multiple times.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=231
This commit is contained in:
Werner Lemberg 2016-12-06 11:13:19 +01:00
parent 602be7c810
commit c0fae7da5a
2 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,3 +1,13 @@
2016-12-06 Werner Lemberg <wl@gnu.org>
* src/type1/t1load.c (parse_subrs): Fix memory leak.
The `subrs' keyword might erroneously occur multiple times.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=231
2016-12-01 Werner Lemberg <wl@gnu.org>
[gzip] Improve building with external zlib (#49673).

13
src/type1/t1load.c
View File

@ -1441,7 +1441,6 @@
FT_Error error;
FT_Int num_subrs;
FT_UInt count;
FT_Hash hash = NULL;
PSAux_Service psaux = (PSAux_Service)face->psaux;
@ -1492,14 +1491,12 @@
( parser->root.limit - parser->root.cursor ) >> 3 ));
num_subrs = ( parser->root.limit - parser->root.cursor ) >> 3;
if ( !hash )
if ( !loader->subrs_hash )
{
if ( FT_NEW( hash ) )
if ( FT_NEW( loader->subrs_hash ) )
goto Fail;
loader->subrs_hash = hash;
error = ft_hash_num_init( hash, memory );
error = ft_hash_num_init( loader->subrs_hash, memory );
if ( error )
goto Fail;
}
@ -1562,9 +1559,9 @@
/* if we use a hash, the subrs index is the key, and a running */
/* counter specified for `T1_Add_Table' acts as the value */
if ( hash )
if ( loader->subrs_hash )
{
ft_hash_num_insert( idx, count, hash, memory );
ft_hash_num_insert( idx, count, loader->subrs_hash, memory );
idx = count;
}