Properly convert static charsets to dynamic charsets.

Fix memory leak in error case (Coverity defects #1820, #1821, #1822).
Fix memory leak (Coverity defect #1819).
prevent crash when invalid include line is parsed (Coverity defect #763).
Fix potential null pointer access (Coverity defect #1804).
Remove dead code (Coverity defect #1194).
Prevent potential null pointer access (Coverity defect #767), ensure error
    value is read (Coverity defect #1195).
reviewed by: plam

diff --git a/ChangeLog b/ChangeLog
index 145ddeebfa68c2726a12458f4025548b32ad286e..fdd376a1c6ec62b6e4701e0e9a0214950174c1a6 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,32 @@
+2006-04-11  Patrick Lam  <plam@mit.edu>
+       * src/fccharset.c (FcCharSetPutLeaf):
+
+       Properly convert static charsets to dynamic charsets.
+
+2006-04-11  Frederic Crozat  <fcrozat@mandriva.com>
+       reviewed by: plam
+       
+       * src/fcpat.c: (FcValueListEntCreate, FcPatternBaseFreeze,
+       FcPatternFreeze):
+       Fix memory leak in error case (Coverity defects #1820, #1821, #1822).
+
+       * src/fclang.c: (FcNameUnparseLangSet):
+       Fix memory leak (Coverity defect #1819).
+
+       * fc-lang/fc-lang.c: (scan):
+       prevent crash when invalid include line is parsed (Coverity defect
+       #763).
+
+       * fc-cat/fc-cat.c: (FcCacheFileRead):
+       Fix potential null pointer access (Coverity defect #1804).
+
+       * src/fcname.c: (FcObjectUnserialize):
+       Remove dead code (Coverity defect #1194).
+
+       * src/fcfreetype.c: (GetScriptTags):
+       Prevent potential null pointer access (Coverity defect #767),
+       ensure error value is read (Coverity defect #1195).
+
 2006-04-11  Behdad Esfahbod  <behdad@cs.toronto.edu>
        reviewed by: plam
 

diff --git a/fc-cat/fc-cat.c b/fc-cat/fc-cat.c
index 80c381c049d560632220cfd669430d1e5ac7391d..09b20f66bf77dd94d052874627c354d46500ebea 100644 (file)
--- a/fc-cat/fc-cat.c
+++ b/fc-cat/fc-cat.c
@@ -244,6 +244,7 @@ FcCacheFileRead (FcFontSet * set, FcStrSet *dirs, char *cache_file)
     char subdirName[FC_MAX_FILE_LEN + 1 + 12 + 1];
     static char name_buf[8192], *dir;
     FcChar8 * ls;
+    char * buf;
 
     if (!cache_file)
         goto bail;
@@ -265,7 +266,8 @@ FcCacheFileRead (FcFontSet * set, FcStrSet *dirs, char *cache_file)
     if (current_arch_start < 0)
         goto bail1;
 
-    while (strlen(FcCacheReadString (fd, subdirName, sizeof (subdirName))) > 0)
+    while ((buf = FcCacheReadString (fd, subdirName, sizeof (subdirName))) 
+          && *buf)
         FcStrSetAdd (dirs, (FcChar8 *)subdirName);
 
     dir = strdup(name_buf);

diff --git a/fc-lang/fc-lang.c b/fc-lang/fc-lang.c
index 6a863e4e6dea689d1fbb01f5ccbfa5d3e08ff23d..b72893b944f2aa0a73a0fbf2ca7f6450fa124fa9 100644 (file)
--- a/fc-lang/fc-lang.c
+++ b/fc-lang/fc-lang.c
@@ -143,6 +143,9 @@ scan (FILE *f, char *file)
        if (!strncmp (line, "include", 7))
        {
            file = strchr (line, ' ');
+            if (!file)
+                fatal (line, lineno, 
+                       "invalid syntax, expected: include filename");
            while (isspace(*file))
                file++;
            f = scanopen (file);

diff --git a/src/fccharset.c b/src/fccharset.c
index d1a9d6ec6ad55bf1f963782abab25cdfcac1956c..531a9b8cc6e8edd8935b0dfd9963c720081c5d30 100644 (file)
--- a/src/fccharset.c
+++ b/src/fccharset.c
@@ -168,6 +168,7 @@ FcCharSetPutLeaf (FcCharSet *fcs,
        return FcFalse;
     if (fcs->bank != FC_BANK_DYNAMIC)
     {
+        /* convert to dynamic */
        int i;
 
        leaves = malloc ((fcs->num + 1) * sizeof (FcCharLeaf *));
@@ -183,6 +184,10 @@ FcCharSetPutLeaf (FcCharSet        *fcs,
            leaves[i] = FcCharSetGetLeaf(fcs, i);
        memcpy (numbers, FcCharSetGetNumbers(fcs), 
                fcs->num * sizeof (FcChar16));
+
+       fcs->bank = FC_BANK_DYNAMIC;
+       fcs->u.dyn.leaves = leaves;
+       fcs->u.dyn.numbers = numbers;
     }
     else
     {

diff --git a/src/fcfreetype.c b/src/fcfreetype.c
index 2689b9f2c63fb196c09db30dc2f2716951116738..5d852a508bf210ceaf12f9a3a9bac469cd4ce721 100644 (file)
--- a/src/fcfreetype.c
+++ b/src/fcfreetype.c
@@ -2744,11 +2744,13 @@ GetScriptTags(FT_Face face, FT_ULong tabletag, FT_ULong **stags, FT_UShort *scri
     FT_Stream  stream = face->stream;
     FT_Error   error;
     FT_UShort          n, p;
-    FT_Memory  memory = stream->memory;
+    FT_Memory  memory;
 
     if ( !stream )
        return TT_Err_Invalid_Face_Handle;
 
+    memory = stream->memory;
+
     if (( error = ftglue_face_goto_table( face, tabletag, stream ) ))
        return error;
 
@@ -2795,7 +2797,7 @@ GetScriptTags(FT_Face face, FT_ULong tabletag, FT_ULong **stags, FT_UShort *scri
 
        cur_offset = ftglue_stream_pos( stream );
 
-       if ( ftglue_stream_seek( stream, new_offset ) )
+       if (( error = ftglue_stream_seek( stream, new_offset ) ))
            goto Fail;
 
        if ( error == TT_Err_Ok )

diff --git a/src/fclang.c b/src/fclang.c
index 7af6ed190498a1d5ee2a14bfb749b40f05799228..4d171acf24cded4ee519fc06d97ab4b5a18e7ce0 100644 (file)
--- a/src/fclang.c
+++ b/src/fclang.c
@@ -567,9 +567,15 @@ FcNameUnparseLangSet (FcStrBuf *buf, const FcLangSet *ls)
        {
            if (!first)
                if (!FcStrBufChar (buf, '|'))
+                {
+                    FcStrListDone (list);
                    return FcFalse;
+                }
            if (!FcStrBufString (buf, extra))
-               return FcFalse;
+                {
+                    FcStrListDone (list);
+                    return FcFalse;
+                }
            first = FcFalse;
        }
     }

diff --git a/src/fcname.c b/src/fcname.c
index 2f6f4e6dbeee6918960091cbeea3cbd30d63d36f..a0a84a394237ceb1f83742a1f8175645ab05f0a0 100644 (file)
--- a/src/fcname.c
+++ b/src/fcname.c
@@ -381,19 +381,11 @@ FcObjectUnserialize (FcCache * metadata, void *block_ptr)
        int i;
        char * bp = (char *)block_ptr;
        FcObjectType * bn;
-       FcObjectTypeList * bnl;
 
        bn = malloc (sizeof (const FcObjectType) * (new_biggest + 1));
        if (!bn)
            return 0;
 
-       bnl = malloc (sizeof (FcObjectTypeList));
-       if (!bnl)
-       {
-           free (bn);
-           return 0;
-       }
-
        for (i = 0; i < new_biggest; i++)
        {
            const FcObjectType * t = FcNameGetObjectType(bp);

diff --git a/src/fcpat.c b/src/fcpat.c
index ba88ebf93360d9bad33294cd14628146ed1b3edf..5865546ca21995d92b0f646f5c736649b097db90 100644 (file)
--- a/src/fcpat.c
+++ b/src/fcpat.c
@@ -399,7 +399,10 @@ FcValueListEntCreate (FcValueListPtr h)
        return 0;
     new = malloc (n * sizeof (FcValueList));
     if (!new)
+    {
+        free (ea);
         return 0;
+    }
     memset(new, 0, n * sizeof (FcValueList));
     FcMemAlloc (FC_MEM_VALLIST, size);
     e = &ea->ent;
@@ -575,11 +578,14 @@ FcPatternBaseFreeze (FcPattern *b)
 
     ep = FcPatternCreate();
     if (!ep)
-        return 0;
+        goto bail;
     ent->pattern = ep;
     epp = malloc(b->num * sizeof (FcPatternElt));
     if (!epp)
+    {
+        FcPatternDestroy (ep);
         goto bail;
+    }
     ep->elts = FcPatternEltPtrCreateDynamic(epp);
 
     FcMemAlloc (FC_MEM_PATELT, sizeof (FcPatternElt)*(b->num));
@@ -650,7 +656,10 @@ FcPatternFreeze (FcPattern *p)
 
     e = malloc(b->num * sizeof (FcPatternElt));
     if (!e)
+    {
+        FcPatternDestroy (b);
         return 0;
+    }
     b->elts = FcPatternEltPtrCreateDynamic(e);
     FcMemAlloc (FC_MEM_PATELT, sizeof (FcPatternElt)*(b->num));