[freetype2] master fb5268c: [base] Fix a leak by broken sfnt-PS or resource fork (#46028).

[suzuki toshiya]

branch: master
commit fb5268cf7b062b91012df7cb864ffaeee642163b
Author: suzuki toshiya <address@hidden>
Commit: suzuki toshiya <address@hidden>

    [base] Fix a leak by broken sfnt-PS or resource fork (#46028).
    
    open_face_from_buffer() frees passed buffer if valid font
    is not found.  But if copying to the buffer is failed,
    the allocated buffer should be freed within the caller.
    
    * src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
    the buffer `sfnt_ps' if an error caused before calling
    open_face_from_buffer().
    (Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
    an error caused before calling open_face_from_buffer();
---
 ChangeLog         |   14 ++++++++++++++
 src/base/ftobjs.c |    8 ++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 6d0941e..9012473 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,18 @@
 2015-09-27  suzuki toshiya  <address@hidden>
+ 
+       [base] Fix a leak by broken sfnt-PS or resource fork (#46028).
+
+       open_face_from_buffer() frees passed buffer if valid font
+       is not found.  But if copying to the buffer is failed,
+       the allocated buffer should be freed within the caller.
+
+       * src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
+       the buffer `sfnt_ps' if an error caused before calling
+       open_face_from_buffer().
+       (Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
+       an error caused before calling open_face_from_buffer();
+
+2015-09-27  suzuki toshiya  <address@hidden>
 
        [mac] Fix buffer size calculation for LWFN font.
 
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index 5d28252..f0c2e77 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1516,8 +1516,10 @@
       goto Exit;
 
     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_ps, length );
-    if ( error )
+    if ( error ) {
+      FT_FREE( sfnt_ps );
       goto Exit;
+    }
 
     error = open_face_from_buffer( library,
                                    sfnt_ps,
@@ -1794,8 +1796,10 @@
     if ( FT_ALLOC( sfnt_data, rlen ) )
       return error;
     error = FT_Stream_Read( stream, (FT_Byte *)sfnt_data, (FT_ULong)rlen );
-    if ( error )
+    if ( error ) {
+      FT_FREE( sfnt_data );
       goto Exit;
+    }
 
     is_cff = rlen > 4 && !ft_memcmp( sfnt_data, "OTTO", 4 );
     error = open_face_from_buffer( library,