commit 8ed5a2477eecf27e645bbb568b66a37eea12973c
author Sebastian Rasmussen <sebras@gmail.com> Fri Jun 19 10:35:57 2020 +0200
committer Werner Lemberg <wl@gnu.org> Fri Jun 19 10:37:50 2020 +0200
tree fc8509f6f304439c85bff8f579ff3f228dfcb501
parent d1180b5f9598088ab1bc9d772e5e09ece0702a38

[cff, cid] Fix segfaults in case of error (#58621).

* src/cff/cffobjs.c (cff_slot_done), src/cid/cidobjs.c
(cid_slot_done): If `ft_glyphslot_init' fails to allocate
`internal', then the class' `done_slot' callback (called by
`ft_glyphslot_done') must not dereference the pointer to `internal'.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index c7c9364..90aa43b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2020-06-19  Sebastian Rasmussen  <sebras@gmail.com>
+
+	[cff, cid] Fix segfaults in case of error (#58621).
+
+	* src/cff/cffobjs.c (cff_slot_done), src/cid/cidobjs.c
+	(cid_slot_done): If `ft_glyphslot_init' fails to allocate
+	`internal', then the class' `done_slot' callback (called by
+	`ft_glyphslot_done') must not dereference the pointer to `internal'.
+
 2020-06-19  Werner Lemberg  <wl@gnu.org>
 
 	[base] Fix UBSAN error.

src/cff/cffobjs.c

diff --git a/src/cff/cffobjs.c b/src/cff/cffobjs.c
index 252f58a..aa959ed 100644
--- a/src/cff/cffobjs.c
+++ b/src/cff/cffobjs.c
@@ -352,7 +352,8 @@
   FT_LOCAL_DEF( void )
   cff_slot_done( FT_GlyphSlot  slot )
   {
-    slot->internal->glyph_hints = NULL;
+    if ( slot->internal )
+      slot->internal->glyph_hints = NULL;
   }
 
 

src/cid/cidobjs.c

diff --git a/src/cid/cidobjs.c b/src/cid/cidobjs.c
index 2d284ca..04b295e 100644
--- a/src/cid/cidobjs.c
+++ b/src/cid/cidobjs.c
@@ -49,7 +49,8 @@
   FT_LOCAL_DEF( void )
   cid_slot_done( FT_GlyphSlot  slot )
   {
-    slot->internal->glyph_hints = NULL;
+    if ( slot->internal )
+      slot->internal->glyph_hints = NULL;
   }