From de02aad9d230b317c9412cfce444a469778fad0c Mon Sep 17 00:00:00 2001 From: giraffedata Date: Tue, 21 Jul 2020 22:01:37 +0000 Subject: Fix double-free crash with -font git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3898 9d0c8265-081b-0410-96cb-a4ca84ce46f8 --- lib/libpbmfont0.c | 5 +---- lib/libpbmfont2.c | 4 +++- 2 files changed, 4 insertions(+), 5 deletions(-) (limited to 'lib') diff --git a/lib/libpbmfont0.c b/lib/libpbmfont0.c index 9c876926..abfd18d2 100644 --- a/lib/libpbmfont0.c +++ b/lib/libpbmfont0.c @@ -253,9 +253,6 @@ pbm_destroybdffont2_base(struct font2 * const font2P) { free(font2P->glyph); - if (font2P->selectorP) - pm_selector_destroy(font2P->selectorP); - if (font2P->oldfont) pbm_freearray(font2P->oldfont, font2P->frows); @@ -275,7 +272,7 @@ pbm_destroybdffont2(struct font2 * const font2P) { if (font2P->load_fn != FIXED_DATA) { destroyGlyphData(font2P->glyph, font2P->maxglyph, font2P->selectorP); - pbm_destroybdffont2_base(font2P); + pbm_destroybdffont2_base(font2P); } } diff --git a/lib/libpbmfont2.c b/lib/libpbmfont2.c index 1560b407..6007d7f6 100644 --- a/lib/libpbmfont2.c +++ b/lib/libpbmfont2.c @@ -1196,8 +1196,10 @@ pbm_loadbdffont2select(const char * const filename, The returned object is in new malloc'ed storage, in many pieces. When done with, destroy with pbm_destroybdffont2(). ------------------------------------------------------------------------------*/ + The returned object refers to *selectorP, so that must continue to exist + until you call pbm_destroybdffont2(). +-----------------------------------------------------------------------------*/ FILE * ifP; Readline readline; struct font2 * font2P; -- cgit 1.4.1