[base] Fix a leak by broken sfnt-PS or resource fork (#46028).

open_face_from_buffer() frees passed buffer if valid font
is not found.  But if copying to the buffer is failed,
the allocated buffer should be freed within the caller.

* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
the buffer `sfnt_ps' if an error caused before calling
open_face_from_buffer().
(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
an error caused before calling open_face_from_buffer();

ChangeLog

@@ -1,3 +1,17 @@
+2015-09-27  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+ 
+	[base] Fix a leak by broken sfnt-PS or resource fork (#46028).
+
+	open_face_from_buffer() frees passed buffer if valid font
+	is not found.  But if copying to the buffer is failed,
+	the allocated buffer should be freed within the caller.
+
+	* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
+	the buffer `sfnt_ps' if an error caused before calling
+	open_face_from_buffer().
+	(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
+	an error caused before calling open_face_from_buffer();
+
 2015-09-27  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
 
 	[mac] Fix buffer size calculation for LWFN font.

src/base/ftobjs.c

@@ -1516,8 +1516,10 @@
       goto Exit;
 
     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_ps, length );
-    if ( error )
+    if ( error ) {
+      FT_FREE( sfnt_ps );
       goto Exit;
+    }
 
     error = open_face_from_buffer( library,
                                    sfnt_ps,
@@ -1794,8 +1796,10 @@
     if ( FT_ALLOC( sfnt_data, rlen ) )
       return error;
     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_data, (FT_ULong)rlen );
-    if ( error )
+    if ( error ) {
+      FT_FREE( sfnt_data );
       goto Exit;
+    }
 
     is_cff = rlen > 4 && !ft_memcmp( sfnt_data, "OTTO", 4 );
     error = open_face_from_buffer( library,