[truetype] Fix dangling `blend` pointer after failed 'gvar' setup.
Since commit a69e39ad9, `ft_var_load_gvar` creates a private blend for
fonts with 'gvar' but no 'fvar' (VARC static component axes) and calls
`tt_done_blend` if loading fails afterwards. That function freed the
blend but left `face->blend` pointing to it while the face stays alive,
causing a heap use-after-free on the next access.
Reported as
https://issues.oss-fuzz.com/issues/564162766
* src/truetype/ttgxvar.c (tt_done_blend): Reset `face->blend`.
* src/truetype/ttobjs.c (tt_face_done): Remove now-redundant reset.
Assisted-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed