[vlc-commits] freetype: Fix a possible buffer corruption

[Thierry Reding]

vlc | branch: master | Thierry Reding <thierry.reding at avionic-design.de> | Tue Jul 24 16:31:13 2012 +0200| [ae3fd8273b0a16b6ab7f17e119b5d1beb79f4a14] | committer: Rafaël Carré

freetype: Fix a possible buffer corruption

Memory associated with a FcPattern is freed when the pattern is
destroyed, so copying the font filename needs to be done before
the call to FcPatternDestroy.

Signed-off-by: Thierry Reding <thierry.reding at avionic-design.de>
Modified-by: Rafaël Carré <funman at videolan.org> (simplify return)
Signed-off-by: Rafaël Carré <funman at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=ae3fd8273b0a16b6ab7f17e119b5d1beb79f4a14
---

 modules/text_renderer/freetype.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/modules/text_renderer/freetype.c b/modules/text_renderer/freetype.c
index 0448ed4..6cd93af 100644
--- a/modules/text_renderer/freetype.c
+++ b/modules/text_renderer/freetype.c
@@ -507,6 +507,7 @@ static char* FontConfig_Select( FcConfig* config, const char* family,
     FcPattern *pat, *p_pat;
     FcChar8* val_s;
     FcBool val_b;
+    char *ret = NULL;
 
     /* Create a pattern and fills it */
     pat = FcPatternCreate();
@@ -563,14 +564,11 @@ static char* FontConfig_Select( FcConfig* config, const char* family,
                             "the requested one: '%s' != '%s'\n",
                             (const char*)val_s, family );   */
 
-    if( FcResultMatch != FcPatternGetString( p_pat, FC_FILE, 0, &val_s ) )
-    {
-        FcPatternDestroy( p_pat );
-        return NULL;
-    }
+    if( FcResultMatch == FcPatternGetString( p_pat, FC_FILE, 0, &val_s ) )
+        ret = strdup( (const char*)val_s );
 
     FcPatternDestroy( p_pat );
-    return strdup( (const char*)val_s );
+    return ret;
 }
 #endif