TextOuputDev: Fix crash when grealloc would overflow

Introduces a new greallocn variant that doesn't free the pointer passed
in case of error, since the pointer holds pointers inside, that would
lead to leak of all those pointers

1 files changed, 8 insertions, 4 deletions

diff --git a/goo/gmem.h b/goo/gmem.h
index 9b187c1d..2eb88be7 100644
--- a/goo/gmem.h
+++ b/goo/gmem.h
@@ -14,7 +14,7 @@
 // under GPL version 2 or later
 //
 // Copyright (C) 2005 Takashi Iwai <tiwai@suse.de>
-// Copyright (C) 2007-2010, 2017 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2007-2010, 2017, 2019 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2008 Jonathan Kew <jonathan_kew@sil.org>
 // Copyright (C) 2018 Adam Reichold <adam.reichold@t-online.de>
 //
@@ -139,9 +139,11 @@ inline void *gmallocn3(int width, int height, int size, bool checkoverflow = fal
   return gmalloc(bytes, checkoverflow);
 }
 
-inline void *greallocn(void *p, int count, int size, bool checkoverflow = false) {
+inline void *greallocn(void *p, int count, int size, bool checkoverflow = false, bool free_p = true) {
   if (count == 0) {
-    gfree(p);
+    if (free_p) {
+      gfree(p);
+    }
     return nullptr;
   }
 
@@ -150,7 +152,9 @@ inline void *greallocn(void *p, int count, int size, bool checkoverflow = false)
     std::fputs("Bogus memory allocation size\n", stderr);
 
     if (checkoverflow) {
-      gfree(p);
+      if (free_p) {
+        gfree(p);
+      }
       return nullptr;
     }