Commit 2bf603bde6f8d8ee307f16a32a986f9879639f1b
2019-09-28T07:37:24
[woff2] Fix memory leaks. One of them reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17766 * src/sfnt/sfwoff2.c (woff2_open_font): Free `info->x_mins' and `woff2->ttc_fonts'. (reconstruct_glyf): Initialize `info->x_mins'.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
diff --git a/ChangeLog b/ChangeLog
index aacd6ee..bc3163f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2019-09-28 Werner Lemberg <wl@gnu.org>
+
+ [woff2] Fix memory leaks.
+
+ One of them reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17766
+
+ * src/sfnt/sfwoff2.c (woff2_open_font): Free `info->x_mins' and
+ `woff2->ttc_fonts'.
+
+ (reconstruct_glyf): Initialize `info->x_mins'.
+
2019-09-27 Alexei Podtelezhnikov <apodtele@gmail.com>
* src/base/ftstroke.c (ft_stroker_cap): Speed up caps.
diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c
index 7d90179..b88d13d 100644
--- a/src/sfnt/sfwoff2.c
+++ b/src/sfnt/sfwoff2.c
@@ -927,6 +927,7 @@
if ( FT_NEW_ARRAY( glyph_buf, glyph_buf_size ) )
goto Fail;
+ info->x_mins = NULL;
if ( FT_NEW_ARRAY( info->x_mins, num_glyphs ) )
goto Fail;
@@ -2007,8 +2008,10 @@
}
/* Collection directory reading complete. */
- FT_TRACE2(( "WOFF2 collection dirtectory is valid.\n" ));
+ FT_TRACE2(( "WOFF2 collection directory is valid.\n" ));
}
+ else
+ woff2.ttc_fonts = NULL;
woff2.compressed_offset = FT_STREAM_POS();
file_offset = ROUND4( woff2.compressed_offset +
@@ -2234,6 +2237,21 @@
FT_FREE( tables );
FT_FREE( indices );
FT_FREE( uncompressed_buf );
+ FT_FREE( info.x_mins );
+
+ if ( woff2.ttc_fonts )
+ {
+ WOFF2_TtcFont ttc_font = woff2.ttc_fonts;
+
+
+ for ( nn = 0; nn < woff2.num_fonts; nn++ )
+ {
+ FT_FREE( ttc_font->table_indices );
+ ttc_font++;
+ }
+
+ FT_FREE( woff2.ttc_fonts );
+ }
if ( error )
{