commit 007c109b4594c5e63948bd08b4d5011ad76ffb10
author Ben Wagner <bungeman@google.com> Fri Oct 23 08:29:14 2020 +0200
committer Werner Lemberg <wl@gnu.org> Fri Oct 23 08:32:30 2020 +0200
tree 4ca679709ce7a329d9460b4af044a94450372759
parent 6a2b3e4007e794bfc6c91030d0ed987f925164a8

* src/sfnt/pngshim.c (Load_SBit_Png): Fix memory leak (#59322).

The issue is that `rows` is allocated but will not be freed in the
event that the call to `png_read_image` fails and calls `longjmp`.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 42f7c34..ff048b8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2020-10-23  Ben Wagner  <bungeman@google.com>
+
+	* src/sfnt/pngshim.c (Load_SBit_Png): Fix memory leak (#59322).
+
+	The issue is that `rows` is allocated but will not be freed in the
+	event that the call to `png_read_image` fails and calls `longjmp`.
+
 2020-10-20  Werner Lemberg  <wl@gnu.org>
 
 	* Version 2.10.4 released.

src/sfnt/pngshim.c

diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index f550161..d4e43a9 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -443,6 +443,7 @@
     png_read_end( png, info );
 
   DestroyExit:
+    FT_FREE( rows );
     png_destroy_read_struct( &png, &info, NULL );
     FT_Stream_Close( &stream );