From b185747dd6128526e4794a0768ac42b1570cc302 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sat, 17 Oct 2015 14:21:41 +0200
Subject: [PATCH] [bdf] Prevent memory leak (#46217).

* src/bdf/bdflib.c (_bdf_parse_glyphs) <STARTCHAR>: Check
_BDF_GLYPH_BITS.
---
 ChangeLog        | 7 +++++++
 src/bdf/bdflib.c | 8 ++++++++
 2 files changed, 15 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 23747712c..7525c106f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-10-17  Werner Lemberg  <wl@gnu.org>
+
+	[bdf] Prevent memory leak (#46217).
+
+	* src/bdf/bdflib.c (_bdf_parse_glyphs) <STARTCHAR>: Check
+	_BDF_GLYPH_BITS.
+
 2015-10-17  Werner Lemberg  <wl@gnu.org>
 
 	[bdf] Use stream size to adjust number of glyphs.
diff --git a/src/bdf/bdflib.c b/src/bdf/bdflib.c
index 9568f1b08..c1619e63c 100644
--- a/src/bdf/bdflib.c
+++ b/src/bdf/bdflib.c
@@ -1650,6 +1650,14 @@
     /* Check for the STARTCHAR field. */
     if ( _bdf_strncmp( line, "STARTCHAR", 9 ) == 0 )
     {
+      if ( p->flags & _BDF_GLYPH_BITS )
+      {
+        /* Missing ENDCHAR field. */
+        FT_ERROR(( "_bdf_parse_glyphs: " ERRMSG1, lineno, "ENDCHAR" ));
+        error = FT_THROW( Missing_Startchar_Field );
+        goto Exit;
+      }
+
       /* Set the character name in the parse info first until the */
       /* encoding can be checked for an unencoded character.      */
       FT_FREE( p->glyph_name );