* src/base/ftobjs.c: Fix double free bug in sfnt-wrapped Type1/CID font support

ChangeLog

@@ -1,3 +1,10 @@
+2008-09-19  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+
+	* src/base/ftobjs.c (Mac_Read_sfnt_Resource): Fix double free bug
+	in sfnt-wrapped Type1 and sfnt-wrapped CID-keyed font support code.
+	open_face_from_buffer() frees the passed buffer when it cannot
+	open a face from the buffer, so the caller must not free it.
+
 2008-09-19  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
 
 	* src/base/ftobjs.c (Mac_Read_sfnt_Resource): Add initial support
@@ -6,6 +13,9 @@
 	table in sfnt table directory. It is used before loading TrueType
 	font driver.
 
+	* docs/CHANGES: Add note about the current status of sfnt-wrapped
+	Type1 and sfnt-wrapped CID-keyed font support.
+
 2008-09-18  Werner Lemberg  <wl@gnu.org>
 
 	* src/base/ftsystem.c (FT_Done_Memory): Use ft_sfree directly for

src/base/ftobjs.c

@@ -1539,8 +1539,6 @@
         FT_FREE( sfnt_data );
         goto Exit;
       }
-
-      FT_FREE( sfnt_ps );
     }
   Try_OpenType:
     error = open_face_from_buffer( library,