[Git][freetype/freetype][master] [truetype] Check avar_segment before access

[Ben Wagner (@bungeman)]

Ben Wagner pushed to branch master at FreeType / FreeType

Commits:

• 9154707f
  by Ben Wagner at 2022-11-09T19:15:26+00:00

  [truetype] Check avar_segment before access
  
  * src/truetype/ttgxvar.c (tt_done_blend): check `avar_segment` before
  accessing to free its `correspondence`.
  
  Reported as:
  
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53062
  

1 changed file:

• src/truetype/ttgxvar.c

Changes:

src/truetype/ttgxvar.c

---

...	...	@@ -4500,9 +4500,12 @@
4500	4500
4501	4501	if ( blend->avar_table )
4502	4502	{
4503		- for ( i = 0; i < num_axes; i++ )
4504		- FT_FREE( blend->avar_table->avar_segment[i].correspondence );
4505		- FT_FREE( blend->avar_table->avar_segment );
	4503	+ if ( blend->avar_table->avar_segment )
	4504	+ {
	4505	+ for ( i = 0; i < num_axes; i++ )
	4506	+ FT_FREE( blend->avar_table->avar_segment[i].correspondence );
	4507	+ FT_FREE( blend->avar_table->avar_segment );
	4508	+ }
4506	4509
4507	4510	tt_var_done_item_variation_store( face,
4508	4511	&blend->avar_table->itemStore );

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. Manage all notifications · Help