walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[ot-layout] Fix nullptr dereference. 

If the `calloc` for `gsub_accels` or `gpos_accels` fails, then the
unlikely branch afterwards can be taken, which frees up the
`hb_ot_layout_t`, but since those fields can now be `nullptr`, then
we don't want to dereference them.
This commit is contained in:
Bruce Mitchener 2018-01-31 22:24:51 +07:00 committed by Behdad Esfahbod
parent 0c66043a92
commit 148ca61075
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hb-ot-layout.cc
View File

@ -195,8 +195,10 @@ _hb_ot_layout_create (hb_face_t *face)
void void
_hb_ot_layout_destroy (hb_ot_layout_t *layout) _hb_ot_layout_destroy (hb_ot_layout_t *layout)
{ {
if (layout->gsub_accels)
for (unsigned int i = 0; i < layout->gsub_lookup_count; i++) for (unsigned int i = 0; i < layout->gsub_lookup_count; i++)
layout->gsub_accels[i].fini (); layout->gsub_accels[i].fini ();
if (layout->gpos_accels)
for (unsigned int i = 0; i < layout->gpos_lookup_count; i++) for (unsigned int i = 0; i < layout->gpos_lookup_count; i++)
layout->gpos_accels[i].fini (); layout->gpos_accels[i].fini ();