diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2022-08-15 10:44:05 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2022-08-21 19:41:45 +0200 |
| commit | 37b718d5899bc4a85425fcc548a7636871808f96 (patch) | |
| tree | 56f51ddc3d2d6dcc163b871e4d1db1b7de4d66f2 | |
| parent | 7cd3f19f21cc9d600e3b765ef2058474d20233e2 (diff) | |
| download | freetype2-37b718d5899bc4a85425fcc548a7636871808f96.tar.gz | |
[base, type1] Better handling of out-of-memory situations.
This follows similar code in `cff_slot_done`.
* src/base/ftobjs.c (ft_glyphslot_done), src/type1/t1objs.c
(T1_GlyphSlot_Done): Check `internal` pointer.
The Type1 problems was reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50057.
| -rw-r--r-- | src/base/ftobjs.c | 5 | ||||
| -rw-r--r-- | src/type1/t1objs.c | 4 |
2 files changed, 6 insertions, 3 deletions
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c index 6d6e0e80a..65945cbeb 100644 --- a/src/base/ftobjs.c +++ b/src/base/ftobjs.c @@ -631,8 +631,9 @@ #ifdef FT_CONFIG_OPTION_SVG if ( slot->face->face_flags & FT_FACE_FLAG_SVG ) { - /* free memory in case SVG was there */ - if ( slot->internal->flags & FT_GLYPH_OWN_GZIP_SVG ) + /* Free memory in case SVG was there. */ + /* `slot->internal` might be NULL in out-of-memory situations. */ + if ( slot->internal && slot->internal->flags & FT_GLYPH_OWN_GZIP_SVG ) { FT_SVG_Document doc = (FT_SVG_Document)slot->other; diff --git a/src/type1/t1objs.c b/src/type1/t1objs.c index 847ae0e64..fa4a13b53 100644 --- a/src/type1/t1objs.c +++ b/src/type1/t1objs.c @@ -146,7 +146,9 @@ FT_LOCAL_DEF( void ) T1_GlyphSlot_Done( FT_GlyphSlot slot ) { - slot->internal->glyph_hints = NULL; + /* `slot->internal` might be NULL in out-of-memory situations. */ + if ( slot->internal ) + slot->internal->glyph_hints = NULL; } |