fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2026-05-05 11:08:12 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'fix_use_after_free_race' into 'master'

Browse source 
Fix usage of FT_Face after FT_Done_Face and unsynchronised access to FT_Library and num_open_faces

Closes #436

See merge request cairo/cairo!81
This commit is contained in:
Michal 2026-01-10 07:28:08 +00:00
commit 76b0dd3a6b
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/cairo-ft-font.c
View file

@ -718,14 +718,18 @@ _cairo_ft_unscaled_font_lock_face (cairo_ft_unscaled_font_t *unscaled)
CAIRO_MUTEX_LOCK (unscaled->mutex);
unscaled->lock_count++;
font_map = _cairo_ft_unscaled_font_map_lock ();
if (unscaled->face)
{
_cairo_ft_unscaled_font_map_unlock ();
return unscaled->face;
}
/* If this unscaled font was created from an FT_Face then we just
* returned it above. */
assert (!unscaled->from_face);
font_map = _cairo_ft_unscaled_font_map_lock ();
{
assert (font_map != NULL);
@ -741,7 +745,6 @@ _cairo_ft_unscaled_font_lock_face (cairo_ft_unscaled_font_t *unscaled)
_font_map_release_face_lock_held (font_map, entry);
}
}
_cairo_ft_unscaled_font_map_unlock ();
error = FT_New_Face (font_map->ft_library,
unscaled->filename,
@ -749,6 +752,7 @@ _cairo_ft_unscaled_font_lock_face (cairo_ft_unscaled_font_t *unscaled)
&face);
if (error)
{
_cairo_ft_unscaled_font_map_unlock ();
unscaled->lock_count--;
CAIRO_MUTEX_UNLOCK (unscaled->mutex);
_cairo_error_throw (_cairo_ft_to_cairo_error (error));
@ -762,6 +766,8 @@ _cairo_ft_unscaled_font_lock_face (cairo_ft_unscaled_font_t *unscaled)
font_map->num_open_faces++;
_cairo_ft_unscaled_font_map_unlock ();
return face;
}