shithub: freetype+ttf2subf

Download patch

ref: 50ff6c1eabec6af45f26fa6b7a5bb67dd9a07f9c
parent: df2cf43e94fcf43d2d4b7574495eb3a0a9d5858a
author: Werner Lemberg <[email protected]>
date: Sat Dec 17 02:44:46 EST 2016

* src/cff/cffload.c (cff_load_private_dict): Always init `blend'.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=295

git/fs: mount .git/fs: mount/attach disallowed
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2016-12-17  Werner Lemberg  <[email protected]>
+
+	* src/cff/cffload.c (cff_load_private_dict): Always init `blend'.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=295
+
 2016-12-16  Werner Lemberg  <[email protected]>
 
 	[truetype] Fix `cvar' sanity test.
--- a/src/cff/cffload.c
+++ b/src/cff/cffload.c
@@ -1843,12 +1843,13 @@
     FT_UInt          stackSize;
 
 
-    if ( !top->private_offset || !top->private_size )
-      goto Exit2;       /* no private DICT, do nothing */
-
-    /* store handle needed to access memory, vstore for blend */
+    /* store handle needed to access memory, vstore for blend;    */
+    /* we need this for clean-up even if there is no private DICT */
     subfont->blend.font   = font;
     subfont->blend.usedBV = FALSE;  /* clear state */
+
+    if ( !top->private_offset || !top->private_size )
+      goto Exit2;       /* no private DICT, do nothing */
 
     /* set defaults */
     FT_ZERO( priv );