walkero
/
fontconfig
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix a dereference of a null pointer 

When exiting from for loop by not satisfying the condition of `(s = next[i])` at FcCacheRemoveUnlocked()
referring s->alloated will be invalid.
This commit is contained in:
Akira TAGOH 2018-11-30 10:42:26 +00:00
parent 3a45b8ef65
commit b047e29954
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/fccache.c
View File

@ -710,6 +710,8 @@ FcCacheRemoveUnlocked (FcCache *cache)
while (fcCacheMaxLevel > 0 && fcCacheChains[fcCacheMaxLevel - 1] == NULL) while (fcCacheMaxLevel > 0 && fcCacheChains[fcCacheMaxLevel - 1] == NULL)
fcCacheMaxLevel--; fcCacheMaxLevel--;
if (s)
{
allocated = s->allocated; allocated = s->allocated;
while (allocated) while (allocated)
{ {
@ -720,6 +722,7 @@ FcCacheRemoveUnlocked (FcCache *cache)
} }
free (s); free (s);
} }
}
static FcCache * static FcCache *
FcCacheFindByStat (struct stat *cache_stat) FcCacheFindByStat (struct stat *cache_stat)