77f1b6
From 007c109b4594c5e63948bd08b4d5011ad76ffb10 Mon Sep 17 00:00:00 2001
77f1b6
From: Ben Wagner <bungeman@google.com>
77f1b6
Date: Fri, 23 Oct 2020 08:29:14 +0200
77f1b6
Subject: [PATCH] * src/sfnt/pngshim.c (Load_SBit_Png): Fix memory leak
77f1b6
 (#59322).
77f1b6
77f1b6
The issue is that `rows` is allocated but will not be freed in the
77f1b6
event that the call to `png_read_image` fails and calls `longjmp`.
77f1b6
---
77f1b6
 ChangeLog          | 7 +++++++
77f1b6
 src/sfnt/pngshim.c | 1 +
77f1b6
 2 files changed, 8 insertions(+)
77f1b6
77f1b6
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
77f1b6
index f55016122..d4e43a9f4 100644
77f1b6
--- a/src/sfnt/pngshim.c
77f1b6
+++ b/src/sfnt/pngshim.c
77f1b6
@@ -443,6 +443,7 @@
77f1b6
     png_read_end( png, info );
77f1b6
 
77f1b6
   DestroyExit:
77f1b6
+    FT_FREE( rows );
77f1b6
     png_destroy_read_struct( &png, &info, NULL );
77f1b6
     FT_Stream_Close( &stream );
77f1b6
 
77f1b6
-- 
77f1b6
2.26.2
77f1b6