| commit | db053ec9a52b31c72e0939c8dc3bec3de70d7521 | [log] [tgz] |
|---|---|---|
| author | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | Fri Sep 17 23:20:00 2010 +0900 |
| committer | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | Fri Sep 17 23:20:00 2010 +0900 |
| tree | 1b64df9bedd3e14878d09d5484d80a9cb9c68aa6 | |
| parent | afd89d309d696f9edd4a383d088cc6c05d00880b [diff] |
[truetype] Don't duplicate size->twilight structure to be freed. * src/truetype/ttinterp.c (free_buffer_in_size): Don't duplicate FT_GlyphZoneRec size->twilight to be freed. If duplicated, FT_FREE() erases the duplicated pointers only and leave original pointers. They can cause the double-free crash when the burst errors occur in TrueType interpreter and free_buffer_in_size() is invoked repeatedly. See Savannah bug #31040 for detail.