minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 9 Releases Wiki Activity

[base] Fix a leak by broken sfnt-PS or resource fork (#46028). 

open_face_from_buffer() frees passed buffer if valid font
is not found.  But if copying to the buffer is failed,
the allocated buffer should be freed within the caller.

* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
the buffer `sfnt_ps' if an error caused before calling
open_face_from_buffer().
(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
an error caused before calling open_face_from_buffer();
This commit is contained in:
suzuki toshiya 2015-09-28 02:01:43 +09:00
parent 8a05d250df
commit fb5268cf7b
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
ChangeLog
View File

@ -1,3 +1,17 @@
2015-09-27 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
[base] Fix a leak by broken sfnt-PS or resource fork (#46028).
open_face_from_buffer() frees passed buffer if valid font
is not found. But if copying to the buffer is failed,
the allocated buffer should be freed within the caller.
* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
the buffer `sfnt_ps' if an error caused before calling
open_face_from_buffer().
(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
an error caused before calling open_face_from_buffer();
2015-09-27 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
[mac] Fix buffer size calculation for LWFN font.

8
src/base/ftobjs.c
View File

@ -1516,8 +1516,10 @@
goto Exit;
error = FT_Stream_Read( stream, (FT_Byte *)sfnt_ps, length );
if ( error )
if ( error ) {
FT_FREE( sfnt_ps );
goto Exit;
}
error = open_face_from_buffer( library,
sfnt_ps,
@ -1794,8 +1796,10 @@
if ( FT_ALLOC( sfnt_data, rlen ) )
return error;
error = FT_Stream_Read( stream, (FT_Byte *)sfnt_data, (FT_ULong)rlen );
if ( error )
if ( error ) {
FT_FREE( sfnt_data );
goto Exit;
}
is_cff = rlen > 4 && !ft_memcmp( sfnt_data, "OTTO", 4 );
error = open_face_from_buffer( library,