[vlc-commits] freetype: Fix a possible buffer corruption

[Thierry Reding]

vlc/vlc-1.1 | branch: master | Thierry Reding <thierry.reding at avionic-design.de> | Thu Aug  9 19:04:18 2012 +0200| [e694e48a9f86a33d4ac7816741e6ea1abb67c20b] | committer: Jean-Baptiste Kempf

freetype: Fix a possible buffer corruption

Memory associated with a FcPattern is freed when the pattern is destroyed,
so copying the font filename needs to be done before the call to FcPatternDestroy.

Manually ported from ae3fd8273b0

Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-1.1.git/?a=commit;h=e694e48a9f86a33d4ac7816741e6ea1abb67c20b
---

 modules/misc/freetype.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/modules/misc/freetype.c b/modules/misc/freetype.c
index 9d282f4..2fe7c10 100644
--- a/modules/misc/freetype.c
+++ b/modules/misc/freetype.c
@@ -2430,6 +2430,7 @@ static char* FontConfig_Select( FcConfig* config, const char* family,
     FcPattern *pat, *p_pat;
     FcChar8* val_s;
     FcBool val_b;
+    char *ret = NULL;
 
     /* Create a pattern and fills it */
     pat = FcPatternCreate();
@@ -2486,14 +2487,11 @@ static char* FontConfig_Select( FcConfig* config, const char* family,
                             "the requested one: '%s' != '%s'\n",
                             (const char*)val_s, family );   */
 
-    if( FcResultMatch != FcPatternGetString( p_pat, FC_FILE, 0, &val_s ) )
-    {
-        FcPatternDestroy( p_pat );
-        return NULL;
-    }
+    if( FcResultMatch == FcPatternGetString( p_pat, FC_FILE, 0, &val_s ) )
+        ret = strdup( (const char*)val_s );
 
     FcPatternDestroy( p_pat );
-    return strdup( (const char*)val_s );
+    return ret;
 }
 #endif /* Fontconfig */
 #else /* From now on, no styles */