shithub: freetype+ttf2subf

Download patch

ref: 922812281cdec91174e627760e1db0d6145e9e91
parent: 6b354931151043015469237fff361628fcd2efca
author: Werner Lemberg <[email protected]>
date: Tue Oct 11 03:12:12 EDT 2016 

* src/truetype/ttgxvar.c (tt_done_blend): Fix deallocation.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2016-10-11  Werner Lemberg  <[email protected]>
+
+	* src/truetype/ttgxvar.c (tt_done_blend): Fix deallocation.
+
 2016-10-08  Werner Lemberg  <[email protected]>
 
 	* src/cid/cidload.c (cid_face_open): Properly propagate `error'.
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -2163,15 +2163,18 @@
   {
     if ( blend != NULL )
     {
-      FT_UInt  i;
+      FT_UInt  i, num_axes;
 
 
+      /* blend->num_axis might not be set up yet */
+      num_axes = blend->mmvar->num_axis;
+
       FT_FREE( blend->normalizedcoords );
       FT_FREE( blend->mmvar );
 
       if ( blend->avar_segment != NULL )
       {
-        for ( i = 0; i < blend->num_axis; i++ )
+        for ( i = 0; i < num_axes; i++ )
           FT_FREE( blend->avar_segment[i].correspondence );
         FT_FREE( blend->avar_segment );
       }