shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[base] Fix a leak by broken sfnt-PS or resource fork (#46028).

open_face_from_buffer() frees passed buffer if valid font
is not found.  But if copying to the buffer is failed,
the allocated buffer should be freed within the caller.

* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
the buffer `sfnt_ps' if an error caused before calling
open_face_from_buffer().
(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
an error caused before calling open_face_from_buffer();

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,4 +1,18 @@

 2015-09-27  suzuki toshiya  <[email protected]>

+ 

+	[base] Fix a leak by broken sfnt-PS or resource fork (#46028).

+

+	open_face_from_buffer() frees passed buffer if valid font

+	is not found.  But if copying to the buffer is failed,

+	the allocated buffer should be freed within the caller.

+

+	* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free

+	the buffer `sfnt_ps' if an error caused before calling

+	open_face_from_buffer().

+	(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if

+	an error caused before calling open_face_from_buffer();

+

+2015-09-27  suzuki toshiya  <[email protected]>

 	[mac] Fix buffer size calculation for LWFN font.

--- a/src/base/ftobjs.c

+++ b/src/base/ftobjs.c

@@ -1516,8 +1516,10 @@

       goto Exit;

     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_ps, length );

-    if ( error )

+    if ( error ) {

+      FT_FREE( sfnt_ps );

       goto Exit;

+    }

     error = open_face_from_buffer( library,

                                    sfnt_ps,

@@ -1794,8 +1796,10 @@

     if ( FT_ALLOC( sfnt_data, rlen ) )

       return error;

     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_data, (FT_ULong)rlen );

-    if ( error )

+    if ( error ) {

+      FT_FREE( sfnt_data );

       goto Exit;

+    }

     is_cff = rlen > 4 && !ft_memcmp( sfnt_data, "OTTO", 4 );

     error = open_face_from_buffer( library,