From 5327092bb28b6df742386d75555ba3ccc6d05ce6 Mon Sep 17 00:00:00 2001 From: Nikhil Ramakrishnan Date: Fri, 20 Sep 2019 06:30:28 +0200 Subject: [woff2] Fix memory leaks. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16896 * src/sfnt/sfwoff2.c (woff2_open_font): Fix error handling. Free `uncompressed_buf'. (reconstruct_font): Free `transformed_buf'. --- ChangeLog | 12 ++++++++++++ src/sfnt/sfwoff2.c | 10 ++++++++-- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index bed580216..3e9cf751f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,15 @@ +2019-09-20 Nikhil Ramakrishnan + + [woff2] Fix memory leaks. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16896 + + * src/sfnt/sfwoff2.c (woff2_open_font): Fix error handling. + Free `uncompressed_buf'. + (reconstruct_font): Free `transformed_buf'. + 2019-09-17 Werner Lemberg * src/otvalid/otvcommon.c (otv_Coverage_get_last): Guard `count'. diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c index bea73c388..bb7c9815b 100644 --- a/src/sfnt/sfwoff2.c +++ b/src/sfnt/sfwoff2.c @@ -1706,6 +1706,7 @@ FT_FREE( table_entry ); FT_Stream_Close( stream ); FT_FREE( stream ); + FT_FREE( transformed_buf ); return error; } @@ -2170,11 +2171,12 @@ woff2.uncompressed_size, stream->cursor, woff2.totalCompressedSize ); - if ( error ) - goto Exit; FT_FRAME_EXIT(); + if ( error ) + goto Exit; + error = reconstruct_font( uncompressed_buf, woff2.uncompressed_size, indices, @@ -2183,6 +2185,9 @@ &sfnt, &sfnt_size, memory ); + + uncompressed_buf = NULL; + if ( error ) goto Exit; @@ -2221,6 +2226,7 @@ Exit: FT_FREE( tables ); FT_FREE( indices ); + FT_FREE( uncompressed_buf ); if ( error ) { -- cgit v1.2.1