diff options
author | Peter Harris <pharris@opentext.com> | 2021-03-02 14:39:45 -0500 |
---|---|---|
committer | Peter Harris <pharris@opentext.com> | 2021-03-02 14:43:55 -0500 |
commit | 9529d2351fe52ffaaf9342343865073d5c5b6802 (patch) | |
tree | 248962046ced42cc1666cbdbddc00c854a6981e8 /src/fontfile/fontdir.c | |
parent | e7b2cae1ad9f07c188bcad27767a2f4fa6e0c2a4 (diff) |
Fix use after free when font server connection lost
If there are multiple blocks waiting for the same font, only one of them
will have ->freeFont set. The rest will be in a state of FS_DEPENDING.
If the font server dies before the font finishes opening, the block with
->freeFont set will call ->unload_font, invalidating the pfont pointers
in the remaining FS_DEPENDING blocks.
Avoid a use after free (and potential crash) by passing conn to
fs_cleanup_font instead of dereferencing pfont to find the conn.
Signed-off-by: Peter Harris <pharris@opentext.com>
Diffstat (limited to 'src/fontfile/fontdir.c')
0 files changed, 0 insertions, 0 deletions