From e9c50fa77de58b749b4b95706f7b55bfff0dd27f Mon Sep 17 00:00:00 2001
From: Alexei Podtelezhnikov <apodtele@gmail.com>
Date: Tue, 16 Mar 2021 22:12:41 -0400
Subject: [PATCH] * src/sfnt/pngshim.c (Load_SBit_Png): Free `rows` once later.

---
 ChangeLog          | 4 ++++
 src/sfnt/pngshim.c | 3 +--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 3535d069d..0405a7344 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2021-03-16  Alexei Podtelezhnikov  <apodtele@gmail.com>
+
+	* src/sfnt/pngshim.c (Load_SBit_Png): Free `rows` once later.
+
 2021-03-16  Ben Wagner  <bungeman@google.com>
 
 	[sfnt] Fix memory leak in png loading.
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index 3ef7b43b4..19b5db8a5 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -441,11 +441,10 @@
 
     png_read_image( png, rows );
 
-    FT_FREE( rows );
-
     png_read_end( png, info );
 
   DestroyExit:
+    /* even if reading fails with longjmp, rows must be freed */
     FT_FREE( rows );
     png_destroy_read_struct( &png, &info, NULL );
     FT_Stream_Close( &stream );