diff options
| author | Osamu Sayama <osamu.sayama@sun.com> | 2010-01-05 17:26:40 -0800 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@sun.com> | 2010-01-06 13:17:40 -0800 |
| commit | 4d4676c0d6324d2ff9d00d15ab485fa5d848a369 (patch) | |
| tree | 8857f5af30310e8e3e6bd44cb4c7ffa20bb70573 | |
| parent | 87529c039050ce3336ff9ce00f1b5a21d15690da (diff) | |
set_fontset_extents crash after get_rotate_fontname fix in 2bef065b70f7
- In set_fontset_extents, check font_data is not NULL before running
loop that may increment it to a non-NULL invalid pointer.
- Make sure get_rotate_fontname counts the final field
Fixes OpenSolaris bug 6913809: X application dumps core in ja_JP.UTF-8 locale
<http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6913809>
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
| -rw-r--r-- | modules/om/generic/omGeneric.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/modules/om/generic/omGeneric.c b/modules/om/generic/omGeneric.c index 4fdc11ba..9b4f336a 100644 --- a/modules/om/generic/omGeneric.c +++ b/modules/om/generic/omGeneric.c @@ -412,11 +412,10 @@ set_fontset_extents( } } - if(font_set->vrotate_num > 0) { + if(font_set->vrotate_num > 0 && font_set->vrotate != NULL) { font_data = (FontData) font_set->vrotate; font_data_count = font_set->vrotate_num; for( ; font_data_count-- ; font_data++) { - if(font_data != NULL) if(font_data->font != NULL) { check_fontset_extents(&overall, &logical_ascent, &logical_descent, @@ -572,6 +571,7 @@ get_rotate_fontname( if((ptr = strchr(ptr, '-'))) { *ptr = '\0'; } else { + field_num++; /* Count last field */ break; } } |