Merge from fontconfig git repository:

Fix fc-cache crash caused by looking up NULL object incorrectly
We were returning a skiplist node when looking up NULL!

2 files changed, 7 insertions, 4 deletions

diff --git a/dist/fontconfig/src/fccache.c b/dist/fontconfig/src/fccache.c
index ddcf07030..610b8f0b7 100644
--- a/dist/fontconfig/src/fccache.c
+++ b/dist/fontconfig/src/fccache.c
@@ -449,6 +449,9 @@ FcCacheFindByAddrUnlocked (void *object)
     FcCacheSkip    **next = fcCacheChains;
     FcCacheSkip    *s;
 
+    if (!object)
+	return NULL;
+
     /*
      * Walk chain pointers one level at a time
      */
@@ -556,7 +559,7 @@ FcCacheObjectDereference (void *object)
     skip = FcCacheFindByAddrUnlocked (object);
     if (skip)
     {
-	if (FcRefDec (&skip->ref) <= 1)
+	if (FcRefDec (&skip->ref) == 1)
 	    FcDirCacheDisposeUnlocked (skip->cache);
     }
     unlock_cache ();
@@ -1109,6 +1112,7 @@ FcDirCacheClean (const FcChar8 *cache_dir, FcBool verbose)
 			    cache_dir, ent->d_name, target_dir);
 		remove = FcTrue;
 	    }
+	    FcDirCacheUnload (cache);
 	}
 	if (remove)
 	{
@@ -1118,7 +1122,6 @@ FcDirCacheClean (const FcChar8 *cache_dir, FcBool verbose)
 		ret = FcFalse;
 	    }
 	}
-	FcDirCacheUnload (cache);
         FcStrFree (file_name);
     }
 
diff --git a/dist/fontconfig/src/fccfg.c b/dist/fontconfig/src/fccfg.c
index 877a4f57e..6b339ee41 100644
--- a/dist/fontconfig/src/fccfg.c
+++ b/dist/fontconfig/src/fccfg.c
@@ -337,8 +337,8 @@ FcConfigAddCache (FcConfig *config, FcCache *cache,
 	    if (!FcConfigAcceptFont (config, font))
 		continue;
 		
-	    nref++;
-	    FcFontSetAdd (config->fonts[set], font);
+	    if (FcFontSetAdd (config->fonts[set], font))
+		nref++;
 	}
 	FcDirCacheReference (cache, nref);
     }