Commit 19cb1127d4a2520126477382f35b489b48530b7e
2015-09-15T08:52:36
[type1, type42] Fix memory leaks (#45966). * src/type1/t1load.c (parse_blend_axis_types): Handle multiple axis names. (parse_blend_design_map): Allow only a single design map. (parse_encoding): Handle multiple encoding vectors. * src/type42/t42parse.c (t42_parse_encoding): Handle multiple encoding vectors.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90
diff --git a/ChangeLog b/ChangeLog
index ec9e8d0..0c689c0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,17 @@
2015-09-15 Werner Lemberg <wl@gnu.org>
+ [type1, type42] Fix memory leaks (#45966).
+
+ * src/type1/t1load.c (parse_blend_axis_types): Handle multiple axis
+ names.
+ (parse_blend_design_map): Allow only a single design map.
+ (parse_encoding): Handle multiple encoding vectors.
+
+ * src/type42/t42parse.c (t42_parse_encoding): Handle multiple
+ encoding vectors.
+
+2015-09-15 Werner Lemberg <wl@gnu.org>
+
[truetype] Fix integer type (#45965).
* src/truetype/ttobjs.c (tt_synth_sfnt_checksum): Implement it.
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 4d065f8..479cb7a 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -615,6 +615,15 @@
goto Exit;
}
+ name = (FT_Byte*)blend->axis_names[n];
+ if ( name )
+ {
+ FT_TRACE0(( "parse_blend_axis_types:"
+ " overwriting axis name `%s' with `%*.s'\n",
+ name, len, token->start ));
+ FT_FREE( name );
+ }
+
if ( FT_ALLOC( blend->axis_names[n], len + 1 ) )
goto Exit;
@@ -787,6 +796,13 @@
goto Exit;
}
+ if ( map->design_points )
+ {
+ FT_ERROR(( "parse_blend_design_map: duplicate table\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Exit;
+ }
+
/* allocate design map data */
if ( FT_NEW_ARRAY( map->design_points, num_points * 2 ) )
goto Exit;
@@ -1205,6 +1221,14 @@
if ( parser->root.cursor >= limit )
return;
+ /* PostScript happily allows overwriting of encoding arrays */
+ if ( encode->char_index )
+ {
+ FT_FREE( encode->char_index );
+ FT_FREE( encode->char_name );
+ T1_Release_Table( char_table );
+ }
+
/* we use a T1_Table to store our charnames */
loader->num_chars = encode->num_chars = count;
if ( FT_NEW_ARRAY( encode->char_index, count ) ||
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index ae062da..ee77d86 100644
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -345,6 +345,14 @@
if ( parser->root.cursor >= limit )
return;
+ /* PostScript happily allows overwriting of encoding arrays */
+ if ( encode->char_index )
+ {
+ FT_FREE( encode->char_index );
+ FT_FREE( encode->char_name );
+ T1_Release_Table( char_table );
+ }
+
/* we use a T1_Table to store our charnames */
loader->num_chars = encode->num_chars = count;
if ( FT_NEW_ARRAY( encode->char_index, count ) ||