In function CFF_Done_Font, make sure that subfonts are freed only if

we are working with a CID keyed CFF font.  This is to avoid freeing a
variable that might not have been allocated.

1 files changed, 7 insertions, 4 deletions

diff --git a/src/cff/cffload.c b/src/cff/cffload.c
index 3df2eaba0..075351fc6 100644
--- a/src/cff/cffload.c
+++ b/src/cff/cffload.c
@@ -2242,11 +2242,14 @@
     cff_done_index( &font->name_index );
     cff_done_index( &font->charstrings_index );
 
-    /* release font dictionaries */
-    for ( index = 0; index < font->num_subfonts; index++ )
-      CFF_Done_SubFont( memory, font->subfonts[index] );
+    /* release font dictionaries, but only if working with a CID keyed CFF font */
+    if ( font->num_subfonts > 0 )
+    {
+      for ( index = 0; index < font->num_subfonts; index++ )
+        CFF_Done_SubFont( memory, font->subfonts[index] );
 
-    FREE( font->subfonts );
+      FREE( font->subfonts );
+    }
 
     CFF_Done_Encoding( &font->encoding, font->stream );
     CFF_Done_Charset( &font->charset, font->stream );