summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNikhil Ramakrishnan <ramakrishnan.nikhil@gmail.com>2019-09-20 06:30:28 +0200
committerWerner Lemberg <wl@gnu.org>2019-09-20 06:30:28 +0200
commit5327092bb28b6df742386d75555ba3ccc6d05ce6 (patch)
treee5bee357aa48d7fbba08232328e848c024ce9091
parent04ebb2a000ee40df2a9900198ec62d79af745b1f (diff)
downloadfreetype2-5327092bb28b6df742386d75555ba3ccc6d05ce6.tar.gz
[woff2] Fix memory leaks.
Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16896 * src/sfnt/sfwoff2.c (woff2_open_font): Fix error handling. Free `uncompressed_buf'. (reconstruct_font): Free `transformed_buf'.
-rw-r--r--ChangeLog12
-rw-r--r--src/sfnt/sfwoff2.c10
2 files changed, 20 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index bed580216..3e9cf751f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2019-09-20 Nikhil Ramakrishnan <ramakrishnan.nikhil@gmail.com>
+
+ [woff2] Fix memory leaks.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16896
+
+ * src/sfnt/sfwoff2.c (woff2_open_font): Fix error handling.
+ Free `uncompressed_buf'.
+ (reconstruct_font): Free `transformed_buf'.
+
2019-09-17 Werner Lemberg <wl@gnu.org>
* src/otvalid/otvcommon.c (otv_Coverage_get_last): Guard `count'.
diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c
index bea73c388..bb7c9815b 100644
--- a/src/sfnt/sfwoff2.c
+++ b/src/sfnt/sfwoff2.c
@@ -1706,6 +1706,7 @@
FT_FREE( table_entry );
FT_Stream_Close( stream );
FT_FREE( stream );
+ FT_FREE( transformed_buf );
return error;
}
@@ -2170,11 +2171,12 @@
woff2.uncompressed_size,
stream->cursor,
woff2.totalCompressedSize );
- if ( error )
- goto Exit;
FT_FRAME_EXIT();
+ if ( error )
+ goto Exit;
+
error = reconstruct_font( uncompressed_buf,
woff2.uncompressed_size,
indices,
@@ -2183,6 +2185,9 @@
&sfnt,
&sfnt_size,
memory );
+
+ uncompressed_buf = NULL;
+
if ( error )
goto Exit;
@@ -2221,6 +2226,7 @@
Exit:
FT_FREE( tables );
FT_FREE( indices );
+ FT_FREE( uncompressed_buf );
if ( error )
{