diff options
author | Werner Lemberg <wl@gnu.org> | 2016-12-06 11:13:19 +0100 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2016-12-06 11:13:19 +0100 |
commit | c0fae7da5a6503c6d38ec133483aba57b42c0ddb (patch) | |
tree | 38dbd6b682a16cffeb628f9b842ed8b16e793e39 /src/type1 | |
parent | 602be7c810634f6d565b45f719e429ec5144dfd3 (diff) | |
download | freetype2-c0fae7da5a6503c6d38ec133483aba57b42c0ddb.tar.gz |
* src/type1/t1load.c (parse_subrs): Fix memory leak.
The `subrs' keyword might erroneously occur multiple times.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=231
Diffstat (limited to 'src/type1')
-rw-r--r-- | src/type1/t1load.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/src/type1/t1load.c b/src/type1/t1load.c index a785c6e44..396f8a578 100644 --- a/src/type1/t1load.c +++ b/src/type1/t1load.c @@ -1441,7 +1441,6 @@ FT_Error error; FT_Int num_subrs; FT_UInt count; - FT_Hash hash = NULL; PSAux_Service psaux = (PSAux_Service)face->psaux; @@ -1492,14 +1491,12 @@ ( parser->root.limit - parser->root.cursor ) >> 3 )); num_subrs = ( parser->root.limit - parser->root.cursor ) >> 3; - if ( !hash ) + if ( !loader->subrs_hash ) { - if ( FT_NEW( hash ) ) + if ( FT_NEW( loader->subrs_hash ) ) goto Fail; - loader->subrs_hash = hash; - - error = ft_hash_num_init( hash, memory ); + error = ft_hash_num_init( loader->subrs_hash, memory ); if ( error ) goto Fail; } @@ -1562,9 +1559,9 @@ /* if we use a hash, the subrs index is the key, and a running */ /* counter specified for `T1_Add_Table' acts as the value */ - if ( hash ) + if ( loader->subrs_hash ) { - ft_hash_num_insert( idx, count, hash, memory ); + ft_hash_num_insert( idx, count, loader->subrs_hash, memory ); idx = count; } |