commit 352ac63ef937629385da7517408cd3d6df7db08a
author Ebrahim Byagowi <ebrahim@gnu.org> Tue Feb 11 03:03:03 2020 +0330
committer Ebrahim Byagowi <ebrahim@gnu.org> Tue Feb 11 03:05:04 2020 +0330
tree 189ee4e9e519f9e0491161dc08f10dbd7f449328
parent 6a390df8af534cc95c19a07ec2bbdd818ade6cac

Fix an unlikely UAF on the deprecated _set_glyph_func API

Fixes https://github.com/harfbuzz/harfbuzz/issues/2168

src/hb-font.cc

diff --git a/src/hb-font.cc b/src/hb-font.cc
index 60fc218..9c732cf 100644
--- a/src/hb-font.cc
+++ b/src/hb-font.cc
@@ -677,7 +677,8 @@
 				 void                        *user_data, \
 				 hb_destroy_func_t            destroy)   \
 {                                                                        \
-  if (hb_object_is_immutable (ffuncs)) {                                 \
+  if (hb_object_is_immutable (ffuncs))                                   \
+  {                                                                      \
     if (destroy)                                                         \
       destroy (user_data);                                               \
     return;                                                              \
@@ -2152,6 +2153,13 @@
 			      hb_font_get_glyph_func_t func,
 			      void *user_data, hb_destroy_func_t destroy)
 {
+  if (hb_object_is_immutable (ffuncs))
+  {
+    if (destroy)
+      destroy (user_data);
+    return;
+  }
+
   hb_font_get_glyph_trampoline_t *trampoline;
 
   trampoline = trampoline_create (func, user_data, destroy);