shithub: freetype+ttf2subf

Download patch

ref: 75534a04327b54f04461a659a92f0b1cd04ac42c
parent: d1ade6d11a1e31253180a19a2e0c6c1af0a8563f
author: Werner Lemberg <[email protected]>
date: Tue Jun 2 20:54:09 EDT 2015 

[truetype] Fix memory leak.

Problem reported by Grissiom <[email protected]>; in

  http://lists.nongnu.org/archive/html/freetype/2015-05/msg00013.html

there is an example code to trigger the bug.

* src/truetype/ttobjs.c (tt_size_init_bytecode): Free old `size'
data before allocating again.  Bug most probably introduced four
years ago in version 2.4.3.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,18 @@
-2015-06-01  Werner Lemberg  <[email protected]>
+2015-06-03  Werner Lemberg  <[email protected]>
+
+	[truetype] Fix memory leak.
+
+	Problem reported by Grissiom <[email protected]>; in
+
+	  http://lists.nongnu.org/archive/html/freetype/2015-05/msg00013.html
+
+	there is an example code to trigger the bug.
+
+	* src/truetype/ttobjs.c (tt_size_init_bytecode): Free old `size'
+	data before allocating again.  Bug most probably introduced four
+	years ago in version 2.4.3.
+
+2015-06-02  Werner Lemberg  <[email protected]>
 
 	[raster] Add more tracing.
 
--- a/src/truetype/ttobjs.c
+++ b/src/truetype/ttobjs.c
@@ -954,6 +954,16 @@
     TT_MaxProfile*  maxp = &face->max_profile;
 
 
+    /* clean up bytecode related data */
+    FT_FREE( size->function_defs );
+    FT_FREE( size->instruction_defs );
+    FT_FREE( size->cvt );
+    FT_FREE( size->storage );
+
+    if ( size->context )
+      TT_Done_Context( size->context );
+    tt_glyphzone_done( &size->twilight );
+
     size->bytecode_ready = -1;
     size->cvt_ready      = -1;