From 223c1384c98caaf9ba5d2cddf7465b7b3a82316b Mon Sep 17 00:00:00 2001
From: Akira TAGOH <akira@tagoh.org>
Date: Fri, 23 Aug 2013 20:42:37 +0900
Subject: [PATCH] Fix a crash when non-builtin objects are edited

---
 src/fccfg.c | 28 +++++++++++-----------------
 src/fcint.h |  5 +++--
 2 files changed, 14 insertions(+), 19 deletions(-)

diff --git a/src/fccfg.c b/src/fccfg.c
index be738d5..d399f7f 100644
--- a/src/fccfg.c
+++ b/src/fccfg.c
@@ -649,8 +649,10 @@ FcConfigAddRule (FcConfig	*config,
 {
     FcSubst	*subst, **prev;
     FcRule	*r;
-    int		num;
+    int		n = 0;
 
+    if (!rule)
+	return FcFalse;
     switch (kind) {
     case FcMatchPattern:
 	prev = &config->substPattern;
@@ -671,7 +673,6 @@ FcConfigAddRule (FcConfig	*config,
     *prev = subst;
     subst->next = NULL;
     subst->rule = rule;
-    num = 0;
     for (r = rule; r; r = r->next)
     {
 	switch (r->type)
@@ -680,19 +681,21 @@ FcConfigAddRule (FcConfig	*config,
 	    if (r->u.test &&
 		r->u.test->kind == FcMatchDefault)
 		r->u.test->kind = kind;
-	    if (r->u.test->object > FC_MAX_BASE_OBJECT)
-		num++;
+
+	    if (n < r->u.test->object)
+		n = r->u.test->object;
 	    break;
 	case FcRuleEdit:
-	    if (r->u.edit->object > FC_MAX_BASE_OBJECT)
-		num++;
+	    if (n < r->u.edit->object)
+		n = r->u.edit->object;
 	    break;
 	default:
 	    break;
 	}
     }
-    if (config->maxObjects < num)
-	config->maxObjects = num;
+    n = FC_OBJ_ID (n) - FC_MAX_BASE_OBJECT;
+    if (config->maxObjects < n)
+	config->maxObjects = n;
     if (FcDebug () & FC_DBG_EDIT)
     {
 	printf ("Add Subst ");
@@ -701,11 +704,6 @@ FcConfigAddRule (FcConfig	*config,
     return FcTrue;
 }
 
-typedef struct _FcSubState {
-    FcPatternElt   *elt;
-    FcValueList    *value;
-} FcSubState;
-
 static FcValue
 FcConfigPromote (FcValue v, FcValue u, FcValuePromotionBuffer *buf)
 {
@@ -1503,8 +1501,6 @@ FcConfigSubstituteWithPat (FcConfig    *config,
     int		    i, nobjs;
     FcBool	    retval = FcTrue;
 
-#define FC_OBJ_ID(_n_)	((_n_) > FC_MAX_BASE_OBJECT ? ((_n_) - FC_EXT_OBJ_INDEX) : (_n_))
-
     if (!config)
     {
 	config = FcConfigGetCurrent ();
@@ -1745,8 +1741,6 @@ bail1:
     if (value)
 	free (value);
 
-#undef FC_OBJ_ID
-
     return retval;
 }
 
diff --git a/src/fcint.h b/src/fcint.h
index ec0c674..362ea6f 100644
--- a/src/fcint.h
+++ b/src/fcint.h
@@ -174,10 +174,11 @@ typedef struct _FcValueList {
 			
 typedef int FcObject;
 
-/* The 1000 is to leave some room for future added internal objects, such
+/* The 1024 is to leave some room for future added internal objects, such
  * that caches from newer fontconfig can still be used with older fontconfig
  * without getting confused. */
-#define FC_EXT_OBJ_INDEX	1000
+#define FC_EXT_OBJ_INDEX	1024
+#define FC_OBJ_ID(_n_)	((_n_) & (~FC_EXT_OBJ_INDEX))
 
 typedef struct _FcPatternElt *FcPatternEltPtr;