From f28c95c4a40842795fb159bff56b5be9fee867cd Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Thu, 17 Sep 2015 19:30:26 +0200
Subject: [PATCH] [type42] Fix memory leak (#45989).

* src/type42/t42parse.c (t42_parse_charstrings): Allow only a single
`CharStrings' array.
---
 ChangeLog             | 7 +++++++
 src/type42/t42parse.c | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 6e90f76d7..511c8cc3e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-09-17  Werner Lemberg  <wl@gnu.org>
+
+	[type42] Fix memory leak (#45989).
+
+	* src/type42/t42parse.c (t42_parse_charstrings): Allow only a single
+	`CharStrings' array.
+
 2015-09-17  Werner Lemberg  <wl@gnu.org>
 
 	[psaux] Fix memory leak (#45986).
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index ee77d8638..003b63ed7 100644
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -841,6 +841,15 @@
 
     /* initialize tables */
 
+    /* contrary to Type1, we disallow multiple CharStrings arrays */
+    if ( swap_table->init )
+    {
+      FT_ERROR(( "t42_parse_charstrings:"
+                 " only one CharStrings array allowed\n" ));
+      error = FT_THROW( Invalid_File_Format );
+      goto Fail;
+    }
+
     error = psaux->ps_table_funcs->init( code_table,
                                          loader->num_glyphs,
                                          memory );