From db053ec9a52b31c72e0939c8dc3bec3de70d7521 Mon Sep 17 00:00:00 2001 From: suzuki toshiya Date: Fri, 17 Sep 2010 23:20:00 +0900 Subject: [PATCH] [truetype] Don't duplicate size->twilight structure to be freed. * src/truetype/ttinterp.c (free_buffer_in_size): Don't duplicate FT_GlyphZoneRec size->twilight to be freed. If duplicated, FT_FREE() erases the duplicated pointers only and leave original pointers. They can cause the double-free crash when the burst errors occur in TrueType interpreter and free_buffer_in_size() is invoked repeatedly. See Savannah bug #31040 for detail. --- ChangeLog | 11 +++++++++++ src/truetype/ttinterp.c | 27 ++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-) diff --git a/ChangeLog b/ChangeLog index ac0ad57e7..2b3307d55 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,14 @@ +2010-09-17 suzuki toshiya + + [truetype] Don't duplicate size->twilight structure to be freed. + + * src/truetype/ttinterp.c (free_buffer_in_size): Don't duplicate + FT_GlyphZoneRec size->twilight to be freed. If duplicated, + FT_FREE() erases the duplicated pointers only and leave original + pointers. They can cause the double-free crash when the burst + errors occur in TrueType interpreter and free_buffer_in_size() + is invoked repeatedly. See Savannah bug #31040 for detail. + 2010-09-15 Werner Lemberg Make bytecode debugging with FontForge work again. diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index 64010091e..f1b7ac354 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -7364,9 +7364,8 @@ static void free_buffer_in_size( TT_ExecContext exc ) { - FT_Memory memory = exc->memory; - TT_Size size = exc->size; - TT_GlyphZoneRec twilight; + FT_Memory memory = exc->memory; + TT_Size size = exc->size; if ( !size ) @@ -7381,18 +7380,16 @@ if ( size->storage ) FT_FREE( size->storage ); - twilight = size->twilight; - - if ( twilight.org ) - FT_FREE( twilight.org ); - if ( twilight.cur ) - FT_FREE( twilight.cur ); - if ( twilight.orus ) - FT_FREE( twilight.orus ); - if ( twilight.tags ) - FT_FREE( twilight.tags ); - if ( twilight.contours ) - FT_FREE( twilight.contours ); + if ( size->twilight.org ) + FT_FREE( size->twilight.org ); + if ( size->twilight.cur ) + FT_FREE( size->twilight.cur ); + if ( size->twilight.orus ) + FT_FREE( size->twilight.orus ); + if ( size->twilight.tags ) + FT_FREE( size->twilight.tags ); + if ( size->twilight.contours ) + FT_FREE( size->twilight.contours ); }