From 07e646cc8422bda778ecf1c084129556a39a0f2a Mon Sep 17 00:00:00 2001
From: Mike FABIAN <mfabian@suse.de>
Date: Thu, 18 Oct 2007 05:44:28 -0700
Subject: [PATCH] Avoid crashes if config files contain junk.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

If ~/.fonts.conf contains:

  <edit mode="assign_replace" name="spacing">
     <int>mono</int>
       </edit>

fontconfig crashes:

    mfabian@magellan:~$ fc-match sans
        Fontconfig error: "~/.fonts.conf", line 46: "mono": not a valid
	integer
	    セグメンテーション違反です (core dumped)
	        mfabian@magellan:~$

Of course the above is nonsense, “mono” is no valid integer indeed.

But I think nevertheless fontconfig should not crash in that case.

The problem was caused by partially truncated expression trees caused by
parse errors -- typechecking these walked the tree without verifying the
integrity of the structure. Of course, the whole tree will be discarded
shortly after being loaded as it contained an error.
---
 src/fcxml.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/fcxml.c b/src/fcxml.c
index 156599c..3b08fea 100644
--- a/src/fcxml.c
+++ b/src/fcxml.c
@@ -558,6 +558,10 @@ FcTypecheckExpr (FcConfigParse *parse, FcExpr *expr, FcType type)
     const FcObjectType	*o;
     const FcConstant	*c;
     
+    /* If parsing the expression failed, some nodes may be NULL */
+    if (!expr)
+	return;
+
     switch (expr->op) {
     case FcOpInteger:
     case FcOpDouble:
-- 
2.39.5