Fix double free (spotted by Coverity, CID #1965).

Check if pattern is not null before using it (Coverity defect #1883).
Fix memory leak with hash collision (Coverity defect #1829).
Fix memory leak when bail cases (Coverity defect #1828).
Don't leak directory name (Coverity defect #1827).
reviewed by: plam

diff --git a/ChangeLog b/ChangeLog
index 02171b18484e4802e70766f5bacde42445424f29..c999df4413a9c10d223c17d442bfe55c6ec54959 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,21 @@
+2006-04-10  Frederic Crozat  <fcrozat@mandriva.com>
+       reviewed by: plam
+
+       * src/fccache.c: (FcDirCacheWrite):
+       Fix double free (spotted by Coverity, CID #1965).
+
+       * fc-match/fc-match.c: (main):
+       Check if pattern is not null before using it (Coverity defect #1883).
+
+       * src/fccache.c: (FcDirCacheWrite):
+       Fix memory leak with hash collision (Coverity defect #1829).
+
+       * src/fccfg.c: (FcConfigBuildFonts):
+       Fix memory leak when bail cases (Coverity defect #1828).
+
+       * src/fccache.c: (FcGlobalCacheLoad):
+       Don't leak directory name (Coverity defect #1827).
+
 2006-04-07  Dominic Lachowicz  <cinamod@hotmail.com>
        reviewed by: plam
        * fc-cache/Makefile.am:

diff --git a/fc-match/fc-match.c b/fc-match/fc-match.c
index 2666620a5c1116b3471fcd694d9aa6274a913d93..fa45018d55589f04f7fe7249470a9ff1b0d22550 100644 (file)
--- a/fc-match/fc-match.c
+++ b/fc-match/fc-match.c
@@ -134,6 +134,9 @@ main (int argc, char **argv)
     else
        pat = FcPatternCreate ();
 
+    if (!pat)
+       return 1;
+
     FcConfigSubstitute (0, pat, FcMatchPattern);
     FcDefaultSubstitute (pat);
     
@@ -147,8 +150,7 @@ main (int argc, char **argv)
        if (match)
            FcFontSetAdd (fs, match);
     }
-    if (pat)
-       FcPatternDestroy (pat);
+    FcPatternDestroy (pat);
 
     if (fs)
     {

diff --git a/src/fccache.c b/src/fccache.c
index 248c6d1584569aa32870f3eb8d2db77f64678fe1..de95f363e8e19bf93a907e4cea78c57d9285c468 100644 (file)
--- a/src/fccache.c
+++ b/src/fccache.c
@@ -236,7 +236,7 @@ FcGlobalCacheLoad (FcGlobalCache    *cache,
             FcCache md;
            off_t off;
 
-           FcStrSetAdd (staleDirs, FcStrCopy ((FcChar8 *)name_buf));
+           FcStrSetAdd (staleDirs, (FcChar8 *)name_buf);
 
            /* skip subdirs */
            while (FcCacheReadString (cache->fd, subdirName, 
@@ -1311,12 +1311,16 @@ FcDirCacheWrite (FcFontSet *set, FcStrSet *dirs, const FcChar8 *dir)
        if(!FcCacheReadString (fd, name_buf, sizeof (name_buf)) || !strlen(name_buf))
        {
            close (fd);
+            FcStrFree ((FcChar8 *)cache_hashed);
            continue;
        }
        close (fd);
 
-       if (strcmp (name_buf, cache_file) != 0)
+       if (strcmp (name_buf, cache_file) != 0) 
+        {
+            FcStrFree ((FcChar8 *)cache_hashed);
            continue;
+        }
 
        break;
     } while (1);
@@ -1445,7 +1449,7 @@ FcDirCacheWrite (FcFontSet *set, FcStrSet *dirs, const FcChar8 *dir)
     free (header);
     close(fd);
     if (!FcAtomicReplaceOrig(atomic))
-        goto bail5;
+        goto bail3;
     FcStrFree ((FcChar8 *)cache_hashed);
     FcStrFree ((FcChar8 *)cache_file);
     FcAtomicUnlock (atomic);

diff --git a/src/fccfg.c b/src/fccfg.c
index cae41b0ccd18ae6f7c3ad6babd22e54626c3d279..7f8a8ff21c156a18e4cc32fa74dd7873c363a3c8 100644 (file)
--- a/src/fccfg.c
+++ b/src/fccfg.c
@@ -335,6 +335,7 @@ FcConfigBuildFonts (FcConfig *config)
     
     return FcTrue;
 bail2:
+    FcGlobalCacheDestroy (cache);
     FcStrSetDestroy (oldDirs);
 bail1:
     FcFontSetDestroy (fonts);