AuroraMiddleware/harfbuzz
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[ot-layout] Fix nullptr dereference.

Browse Source 
If the `calloc` for `gsub_accels` or `gpos_accels` fails, then the
unlikely branch afterwards can be taken, which frees up the
`hb_ot_layout_t`, but since those fields can now be `nullptr`, then
we don't want to dereference them.
This commit is contained in:
Bruce Mitchener 2018-01-31 22:24:51 +07:00 committed by Behdad Esfahbod
parent 0c66043a92
commit 148ca61075
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/hb-ot-layout.cc
View File

@ -195,10 +195,12 @@ _hb_ot_layout_create (hb_face_t *face)
void
_hb_ot_layout_destroy (hb_ot_layout_t *layout)
{
for (unsigned int i = 0; i < layout->gsub_lookup_count; i++)
layout->gsub_accels[i].fini ();
for (unsigned int i = 0; i < layout->gpos_lookup_count; i++)
layout->gpos_accels[i].fini ();
if (layout->gsub_accels)
for (unsigned int i = 0; i < layout->gsub_lookup_count; i++)
layout->gsub_accels[i].fini ();
if (layout->gpos_accels)
for (unsigned int i = 0; i < layout->gpos_lookup_count; i++)
layout->gpos_accels[i].fini ();
free (layout->gsub_accels);
free (layout->gpos_accels);