diff options
author | Nikhil Ramakrishnan <ramakrishnan.nikhil@gmail.com> | 2019-09-20 06:30:28 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2019-09-20 06:30:28 +0200 |
commit | 5327092bb28b6df742386d75555ba3ccc6d05ce6 (patch) | |
tree | e5bee357aa48d7fbba08232328e848c024ce9091 | |
parent | 04ebb2a000ee40df2a9900198ec62d79af745b1f (diff) | |
download | freetype2-5327092bb28b6df742386d75555ba3ccc6d05ce6.tar.gz |
[woff2] Fix memory leaks.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16896
* src/sfnt/sfwoff2.c (woff2_open_font): Fix error handling.
Free `uncompressed_buf'.
(reconstruct_font): Free `transformed_buf'.
-rw-r--r-- | ChangeLog | 12 | ||||
-rw-r--r-- | src/sfnt/sfwoff2.c | 10 |
2 files changed, 20 insertions, 2 deletions
@@ -1,3 +1,15 @@ +2019-09-20 Nikhil Ramakrishnan <ramakrishnan.nikhil@gmail.com> + + [woff2] Fix memory leaks. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16896 + + * src/sfnt/sfwoff2.c (woff2_open_font): Fix error handling. + Free `uncompressed_buf'. + (reconstruct_font): Free `transformed_buf'. + 2019-09-17 Werner Lemberg <wl@gnu.org> * src/otvalid/otvcommon.c (otv_Coverage_get_last): Guard `count'. diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c index bea73c388..bb7c9815b 100644 --- a/src/sfnt/sfwoff2.c +++ b/src/sfnt/sfwoff2.c @@ -1706,6 +1706,7 @@ FT_FREE( table_entry ); FT_Stream_Close( stream ); FT_FREE( stream ); + FT_FREE( transformed_buf ); return error; } @@ -2170,11 +2171,12 @@ woff2.uncompressed_size, stream->cursor, woff2.totalCompressedSize ); - if ( error ) - goto Exit; FT_FRAME_EXIT(); + if ( error ) + goto Exit; + error = reconstruct_font( uncompressed_buf, woff2.uncompressed_size, indices, @@ -2183,6 +2185,9 @@ &sfnt, &sfnt_size, memory ); + + uncompressed_buf = NULL; + if ( error ) goto Exit; @@ -2221,6 +2226,7 @@ Exit: FT_FREE( tables ); FT_FREE( indices ); + FT_FREE( uncompressed_buf ); if ( error ) { |