Gracefully handle the case where a cache asserts that it has a negative

    number of fonts, causing overflow.
reviewed by: plam

diff --git a/ChangeLog b/ChangeLog
index 0a8dbb917042e1223b722385a7ae84669aefa649..fa13d7b9cef95e92ff8baca66ceb6914d2f069d5 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2006-02-03  Dirk Mueller  <dmueller@suse.de>
+       reviewed by: plam
+
+       * src/fcfs.c (FcFontSetUnserialize):
+
+       Gracefully handle the case where a cache asserts that it
+       has a negative number of fonts, causing overflow.
+
 2006-02-03  Patrick Lam  <plam@mit.edu>
        * src/fccache.c (FcDirCacheUnlink):
 

diff --git a/src/fcfs.c b/src/fcfs.c
index a9e300dba20ab24e436bb759a08d202a0e99d261..3be8c79d7ab9eae603b64bd2e540799c47895800 100644 (file)
--- a/src/fcfs.c
+++ b/src/fcfs.c
@@ -159,23 +159,23 @@ FcFontSetUnserialize(FcCache * metadata, FcFontSet * s, void * block_ptr)
     nfont = *(int *)block_ptr;
     block_ptr = (int *)block_ptr + 1;
 
-    if (s->sfont < s->nfont + nfont)
-    {
-       int sfont = s->nfont + nfont;
-       FcPattern ** pp;
-       pp = realloc (s->fonts, sfont * sizeof (FcPattern));
-       if (!pp)
-           return FcFalse;
-       s->fonts = pp;
-       s->sfont = sfont;
-    }
-    n = s->nfont;
-    s->nfont += nfont;
-
     if (nfont > 0)
     {
        FcPattern * p = (FcPattern *)block_ptr;
 
+       if (s->sfont < s->nfont + nfont)
+       {
+           int sfont = s->nfont + nfont;
+           FcPattern ** pp;
+           pp = realloc (s->fonts, sfont * sizeof (FcPattern));
+           if (!pp)
+               return FcFalse;
+           s->fonts = pp;
+           s->sfont = sfont;
+       }
+       n = s->nfont;
+       s->nfont += nfont;
+
         /* The following line is a bit counterintuitive.  The usual
          * convention is that FcPatternUnserialize is responsible for
          * aligning the FcPattern.  However, the FontSet also stores
@@ -187,7 +187,8 @@ FcFontSetUnserialize(FcCache * metadata, FcFontSet * s, void * block_ptr)
 
        block_ptr = FcPatternUnserialize (metadata, block_ptr);
        block_ptr = FcObjectUnserialize (metadata, block_ptr);
+       return block_ptr != 0;
     }
 
-    return block_ptr != 0;
+    return FcFalse;
 }