Skip to content
GitLab
  • Menu
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • F fontconfig
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 173
    • Issues 173
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 21
    • Merge requests 21
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • fontconfig
  • fontconfig
  • Issues
  • #237
Closed
Open
Created Apr 28, 2020 by Jonathan Kew@jfkthame

Potential double-free of the name_mapping pointer in FcFreeTypeQueryFaceInternal

I think there's a potential double-free bug in the FcFreeTypeQueryFaceInternal function, introduced in 61573ad5.

If no nm_share pointer is passed in, the name_mapping pointer will be allocated at https://gitlab.freedesktop.org/fontconfig/fontconfig/-/blob/master/src/fcfreetype.c#L1443.

It will then (again, provided nm_share is null) be freed at https://gitlab.freedesktop.org/fontconfig/fontconfig/-/blob/master/src/fcfreetype.c#L1630.

But if something subsequently fails, and we jump to the bail1 cleanup code at https://gitlab.freedesktop.org/fontconfig/fontconfig/-/blob/master/src/fcfreetype.c#L2201, the already-freed name_mapping pointer will be freed again, AFAICS.

A simple fix would be to reset the pointer to NULL when it is freed in the main body of the function.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking