Index: ChangeLog
===================================================================
RCS file: /cvs/freetype/freetype2/ChangeLog,v
retrieving revision 1.688
diff -u -p -r1.688 ChangeLog
--- ChangeLog	2003/06/25 06:13:31	1.688
+++ ChangeLog	2003/06/25 14:38:30
@@ -1,3 +1,9 @@
+2003-06-25  Owen Taylor  <address@hidden>
+
+	* src/sfnt/ttload.c (tt_face_load_hdmx): Don't assign
+	num_records until we actually decide to load the table,
+	otherwise, we'll segfault in tt_face_free_hdmx.
+
 2003-06-24  Werner Lemberg  <address@hidden>
 
 	* src/cff/cffdrivr.c (cff_get_glyph_name): Protect agains zero
Index: src/sfnt/ttload.c
===================================================================
RCS file: /cvs/freetype/freetype2/src/sfnt/ttload.c,v
retrieving revision 1.101
diff -u -p -r1.101 ttload.c
--- ttload.c	2003/06/22 15:33:53	1.101
+++ ttload.c	2003/06/25 14:38:30
@@ -1776,6 +1776,7 @@
     FT_Memory  memory = stream->memory;
 
     TT_Hdmx    hdmx = &face->hdmx;
+    FT_Short   num_records;
     FT_Long    num_glyphs;
     FT_Long    record_size;
 
@@ -1793,7 +1794,7 @@
       goto Exit;
 
     hdmx->version     = FT_GET_USHORT();
-    hdmx->num_records = FT_GET_SHORT();
+    num_records       = FT_GET_SHORT();
     record_size       = FT_GET_LONG();
 
     FT_FRAME_EXIT();
@@ -1802,9 +1803,10 @@
     if ( hdmx->version != 0 )
       goto Exit;
 
-    if ( FT_NEW_ARRAY( hdmx->records, hdmx->num_records ) )
+    if ( FT_NEW_ARRAY( hdmx->records, num_records ) )
       goto Exit;
 
+    hdmx->num_records = num_records;
     num_glyphs   = face->root.num_glyphs;
     record_size -= num_glyphs + 2;