Fix double-free crash with -font

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3898 9d0c8265-081b-0410-96cb-a4ca84ce46f8

2 files changed, 4 insertions, 5 deletions

diff --git a/lib/libpbmfont0.c b/lib/libpbmfont0.c
index 9c876926..abfd18d2 100644
--- a/lib/libpbmfont0.c
+++ b/lib/libpbmfont0.c
@@ -253,9 +253,6 @@ pbm_destroybdffont2_base(struct font2 * const font2P) {
 
     free(font2P->glyph);
 
-    if (font2P->selectorP)
-        pm_selector_destroy(font2P->selectorP);
-
     if (font2P->oldfont)
        pbm_freearray(font2P->oldfont, font2P->frows);
 
@@ -275,7 +272,7 @@ pbm_destroybdffont2(struct font2 * const font2P) {
 
     if (font2P->load_fn != FIXED_DATA) {
         destroyGlyphData(font2P->glyph, font2P->maxglyph, font2P->selectorP);
-                         pbm_destroybdffont2_base(font2P);
+        pbm_destroybdffont2_base(font2P);
     }
 }
 
diff --git a/lib/libpbmfont2.c b/lib/libpbmfont2.c
index 1560b407..6007d7f6 100644
--- a/lib/libpbmfont2.c
+++ b/lib/libpbmfont2.c
@@ -1196,8 +1196,10 @@ pbm_loadbdffont2select(const char *               const filename,
 
    The returned object is in new malloc'ed storage, in many pieces.
    When done with, destroy with pbm_destroybdffont2().
------------------------------------------------------------------------------*/
 
+   The returned object refers to *selectorP, so that must continue to exist
+   until you call pbm_destroybdffont2().
+-----------------------------------------------------------------------------*/
     FILE *         ifP;
     Readline       readline;
     struct font2 * font2P;