walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix an unlikely UAF on the deprecated _set_glyph_func API 

Fixes https://github.com/harfbuzz/harfbuzz/issues/2168
This commit is contained in:
Ebrahim Byagowi 2020-02-11 03:03:03 +03:30
parent 6a390df8af
commit 352ac63ef9
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/hb-font.cc
View File

@ -677,7 +677,8 @@ hb_font_funcs_set_##name##_func (hb_font_funcs_t *ffuncs, \
void *user_data, \ void *user_data, \
hb_destroy_func_t destroy) \ hb_destroy_func_t destroy) \
{ \ { \
if (hb_object_is_immutable (ffuncs)) { \ if (hb_object_is_immutable (ffuncs)) \
{ \
if (destroy) \ if (destroy) \
destroy (user_data); \ destroy (user_data); \
return; \ return; \
@ -2152,6 +2153,13 @@ hb_font_funcs_set_glyph_func (hb_font_funcs_t *ffuncs,
hb_font_get_glyph_func_t func, hb_font_get_glyph_func_t func,
void *user_data, hb_destroy_func_t destroy) void *user_data, hb_destroy_func_t destroy)
{ {
if (hb_object_is_immutable (ffuncs))
{
if (destroy)
destroy (user_data);
return;
}
hb_font_get_glyph_trampoline_t *trampoline; hb_font_get_glyph_trampoline_t *trampoline;
trampoline = trampoline_create (func, user_data, destroy); trampoline = trampoline_create (func, user_data, destroy);