mirrors/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[truetype] Check avar_segment before access

Browse Source 
* src/truetype/ttgxvar.c (tt_done_blend): check `avar_segment` before
accessing to free its `correspondence`.

Reported as:

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53062
This commit is contained in:
Ben Wagner 2022-11-07 16:58:56 -05:00
parent d38407f79e
commit 9154707f6b
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/truetype/ttgxvar.c
View File

@ -4500,9 +4500,12 @@
if ( blend->avar_table )
{
for ( i = 0; i < num_axes; i++ )
FT_FREE( blend->avar_table->avar_segment[i].correspondence );
FT_FREE( blend->avar_table->avar_segment );
if ( blend->avar_table->avar_segment )
{
for ( i = 0; i < num_axes; i++ )
FT_FREE( blend->avar_table->avar_segment[i].correspondence );
FT_FREE( blend->avar_table->avar_segment );
}
tt_var_done_item_variation_store( face,
&blend->avar_table->itemStore );