[cff] Fix another two memory leaks (#58629).

* src/cff/cffobjs.c (cff_size_init): If a call to `funcs->create'
fails to allocate one of the `internal->subfont' variables, make
sure to free `internal->topfont' and any successfully allocated
subfonts.

2 files changed, 39 insertions, 24 deletions

diff --git a/ChangeLog b/ChangeLog
index 19967d709..3473057b3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
 2020-06-19  Sebastian Rasmussen  <sebras@gmail.com>
 
+	[cff] Fix another two memory leaks (#58629).
+
+	* src/cff/cffobjs.c (cff_size_init): If a call to `funcs->create'
+	fails to allocate one of the `internal->subfont' variables, make
+	sure to free `internal->topfont' and any successfully allocated
+	subfonts.
+
+2020-06-19  Sebastian Rasmussen  <sebras@gmail.com>
+
 	[psaux] Fix memory leak (#58626).
 
 	* src/psaux/psstack.c (cf2_stack_init): If `cf2_stack_init' fails to
diff --git a/src/cff/cffobjs.c b/src/cff/cffobjs.c
index aa959ede9..51430b2e3 100644
--- a/src/cff/cffobjs.c
+++ b/src/cff/cffobjs.c
@@ -168,47 +168,53 @@
 
     FT_Memory     memory   = cffsize->face->memory;
     CFF_Internal  internal = NULL;
+    CFF_Face      face     = (CFF_Face)cffsize->face;
+    CFF_Font      font     = (CFF_Font)face->extra.data;
 
+    PS_PrivateRec priv;
 
-    if ( funcs )
-    {
-      CFF_Face  face = (CFF_Face)cffsize->face;
-      CFF_Font  font = (CFF_Font)face->extra.data;
-
-      PS_PrivateRec  priv;
-
-      FT_UInt  i;
+    FT_UInt       i;
 
+    if ( !funcs )
+      goto Exit;
 
-      if ( FT_NEW( internal ) )
-        goto Exit;
+    if ( FT_NEW( internal ) )
+      goto Exit;
 
-      cff_make_private_dict( &font->top_font, &priv );
-      error = funcs->create( cffsize->face->memory, &priv,
+    cff_make_private_dict( &font->top_font, &priv );
+    error = funcs->create( cffsize->face->memory, &priv,
                              &internal->topfont );
-      if ( error )
-        goto Exit;
+    if ( error )
+      goto Exit;
 
-      for ( i = font->num_subfonts; i > 0; i-- )
-      {
-        CFF_SubFont  sub = font->subfonts[i - 1];
+    for ( i = font->num_subfonts; i > 0; i-- )
+    {
+      CFF_SubFont  sub = font->subfonts[i - 1];
 
 
-        cff_make_private_dict( sub, &priv );
-        error = funcs->create( cffsize->face->memory, &priv,
+      cff_make_private_dict( sub, &priv );
+      error = funcs->create( cffsize->face->memory, &priv,
                                &internal->subfonts[i - 1] );
-        if ( error )
-          goto Exit;
-      }
-
-      cffsize->internal->module_data = internal;
+      if ( error )
+        goto Exit;
     }
 
+    cffsize->internal->module_data = internal;
+
     size->strike_index = 0xFFFFFFFFUL;
 
   Exit:
     if ( error )
+    {
+      if ( internal )
+      {
+        for ( i = font->num_subfonts; i > 0; i-- )
+          FT_FREE( internal->subfonts[i - 1] );
+        FT_FREE( internal->topfont );
+      }
+
       FT_FREE( internal );
+    }
 
     return error;
   }