[type42] Fix memory leak (#45989).

* src/type42/t42parse.c (t42_parse_charstrings): Allow only a single
`CharStrings' array.

ChangeLog

@@ -1,3 +1,10 @@
+2015-09-17  Werner Lemberg  <wl@gnu.org>
+
+	[type42] Fix memory leak (#45989).
+
+	* src/type42/t42parse.c (t42_parse_charstrings): Allow only a single
+	`CharStrings' array.
+
 2015-09-17  Werner Lemberg  <wl@gnu.org>
 
 	[psaux] Fix memory leak (#45986).

src/type42/t42parse.c

@@ -841,6 +841,15 @@
 
     /* initialize tables */
 
+    /* contrary to Type1, we disallow multiple CharStrings arrays */
+    if ( swap_table->init )
+    {
+      FT_ERROR(( "t42_parse_charstrings:"
+                 " only one CharStrings array allowed\n" ));
+      error = FT_THROW( Invalid_File_Format );
+      goto Fail;
+    }
+
     error = psaux->ps_table_funcs->init( code_table,
                                          loader->num_glyphs,
                                          memory );