[Devel] freetype 2.1.5 - SEGV on Type1 fonts with non-zero PaintType or StrokeWidth

[Jakub Bogusz]

Hello,

I found that after upgrade to freetype 2.1.5 some utilities (e.g.
mkfontscale and fc-cache from recent XFree86) cause SEGV on some Type1
fonts from ghostscript-fonts-other package (namely hr*.pfb).
It crashed on free(), in FT_Done_Face/T1_Done_Face/T1_Free chain.

After some debugging I found, that it's caused by trying to free
type1->paint_type field (src/type1/t1objs.c:232), which was
initialized as just int, not pointer to int.
It seems that the same applies to type1->stroke_width field, and similar
code in type42 subdirectory.
(hr*.pfb fonts have non-zero PaintType and StrokeWidth fields, while all
other fonts have zeros)

After applying attached patch mentioned utilities don't cause SEGV any
longer.


-- 
Jakub Bogusz    http://cyber.cs.net.pl/~qboosh/
PLD Linux       http://www.pld-linux.org/

freetype-free.patch
Description: Text document