diff options
| author | Werner Lemberg <wl@gnu.org> | 2020-01-03 18:09:12 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2020-01-03 18:09:12 +0100 |
| commit | a99a8e2863a44dcf7397e27f73655e4e0cc36704 (patch) | |
| tree | b8bfb0de3fcd54ddc1ef69824826ebbd6f8543a1 /src | |
| parent | 10d8de7541ab1f26f6f04b2118d13a92a7119102 (diff) | |
| download | freetype2-a99a8e2863a44dcf7397e27f73655e4e0cc36704.tar.gz | |
[woff2] Fix memory leaks and a runtime warning.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19773
* src/sfnt/sfwoff2.c (compute_ULong_sum): Add missing cast.
(reconstruct_hmtx): Add missing deallocation calls.
Diffstat (limited to 'src')
| -rw-r--r-- | src/sfnt/sfwoff2.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c index 36ae6e703..23e826f3c 100644 --- a/src/sfnt/sfwoff2.c +++ b/src/sfnt/sfwoff2.c @@ -302,7 +302,7 @@ { v = 0; for ( i = aligned_size ; i < size; ++i ) - v |= buf[i] << ( 24 - 8 * ( i & 3 ) ); + v |= (FT_ULong)buf[i] << ( 24 - 8 * ( i & 3 ) ); checksum += v; } @@ -1465,9 +1465,17 @@ *sfnt_bytes = sfnt; *out_offset = dest_offset; + FT_FREE( advance_widths ); + FT_FREE( lsbs ); + FT_FREE( hmtx_table ); + return error; Fail: + FT_FREE( advance_widths ); + FT_FREE( lsbs ); + FT_FREE( hmtx_table ); + if ( !error ) error = FT_THROW( Invalid_Table ); |