In function CFF_Done_Font, make sure that subfonts are freed only if we are working with a CID keyed CFF font. This is to avoid freeing a variable that might not have been allocated.
diff --git a/src/cff/cffload.c b/src/cff/cffload.c
index 3df2eab..075351f 100644
--- a/src/cff/cffload.c
+++ b/src/cff/cffload.c
@@ -2242,11 +2242,14 @@
cff_done_index( &font->name_index );
cff_done_index( &font->charstrings_index );
- /* release font dictionaries */
- for ( index = 0; index < font->num_subfonts; index++ )
- CFF_Done_SubFont( memory, font->subfonts[index] );
+ /* release font dictionaries, but only if working with a CID keyed CFF font */
+ if ( font->num_subfonts > 0 )
+ {
+ for ( index = 0; index < font->num_subfonts; index++ )
+ CFF_Done_SubFont( memory, font->subfonts[index] );
- FREE( font->subfonts );
+ FREE( font->subfonts );
+ }
CFF_Done_Encoding( &font->encoding, font->stream );
CFF_Done_Charset( &font->charset, font->stream );