Fix a dereference of a null pointer
When exiting from for loop by not satisfying the condition of `(s = next[i])` at FcCacheRemoveUnlocked()
referring s->alloated will be invalid.
diff --git a/src/fccache.c b/src/fccache.c
index 87073ba..3352a66 100644
--- a/src/fccache.c
+++ b/src/fccache.c
@@ -710,15 +710,18 @@
while (fcCacheMaxLevel > 0 && fcCacheChains[fcCacheMaxLevel - 1] == NULL)
fcCacheMaxLevel--;
- allocated = s->allocated;
- while (allocated)
+ if (s)
{
- /* First element in allocated chunk is the free list */
- next = *(void **)allocated;
- free (allocated);
- allocated = next;
+ allocated = s->allocated;
+ while (allocated)
+ {
+ /* First element in allocated chunk is the free list */
+ next = *(void **)allocated;
+ free (allocated);
+ allocated = next;
+ }
+ free (s);
}
- free (s);
}
static FcCache *
