commit 665584a19b0ec227c93643ffb0540d11ac8ecf7f
author Akira TAGOH <akira@tagoh.org> Tue Nov 14 20:55:24 2017 +0900
committer Akira TAGOH <akira@tagoh.org> Tue Nov 14 20:59:27 2017 +0900
tree 1e25f5ea6c5edbe9c83c8a45e28d9f0588763f14
parent bc0240bf12ea419c7c806575de43bb903f150e49

Validate cache more carefully

Reject caches when FcPattern isn't a constant.
This is usually unlikely to happen but reported.
I've decided to add more validation since this isn't reproducible
and easy to have a workaround rather than investigating 'why'.

https://bugs.freedesktop.org/show_bug.cgi?id=103237

src/fccache.c

diff --git a/src/fccache.c b/src/fccache.c
index 6f3c68a..c59ea19 100644
--- a/src/fccache.c
+++ b/src/fccache.c
@@ -646,7 +646,8 @@
                 (char *) font > end - sizeof (FcFontSet) ||
                 font->elts_offset < 0 ||
                 font->elts_offset > end - (char *) font ||
-                font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt))
+                font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt) ||
+		!FcRefIsConst (&font->ref))
                 return FcFalse;