commit e9c50fa77de58b749b4b95706f7b55bfff0dd27f
author Alexei Podtelezhnikov <apodtele@gmail.com> Tue Mar 16 22:12:41 2021 -0400
committer Alexei Podtelezhnikov <apodtele@gmail.com> Tue Mar 16 22:12:41 2021 -0400
tree 1394b8f8674694d7e5da1a45938d601447fda77a
parent b0729b8fbb18dc1340ade628facf3f1cee498bfb

* src/sfnt/pngshim.c (Load_SBit_Png): Free `rows` once later.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 3535d06..0405a73 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2021-03-16  Alexei Podtelezhnikov  <apodtele@gmail.com>
+
+	* src/sfnt/pngshim.c (Load_SBit_Png): Free `rows` once later.
+
 2021-03-16  Ben Wagner  <bungeman@google.com>
 
 	[sfnt] Fix memory leak in png loading.

src/sfnt/pngshim.c

diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index 3ef7b43..19b5db8 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -441,11 +441,10 @@
 
     png_read_image( png, rows );
 
-    FT_FREE( rows );
-
     png_read_end( png, info );
 
   DestroyExit:
+    /* even if reading fails with longjmp, rows must be freed */
     FT_FREE( rows );
     png_destroy_read_struct( &png, &info, NULL );
     FT_Stream_Close( &stream );