commit b8db819768b16ac4e529a4e4c34b2c5fa83cc389
author Alexei Podtelezhnikov <apodtele@gmail.com> Mon May 13 02:38:38 2024
committer Alexei Podtelezhnikov <apodtele@gmail.com> Mon May 13 02:38:38 2024
tree ad7c4f71985de1faac3d39f869ff09930d708590
parent 5b1cde804da66ce0074be7a96dd7732a47972e4a

[type1/MM] Safer handle arrays of different types.

* src/type1/t1load.c (parse_blend_design_map): Separately allocate...
(T1_Done_Blend): ... and free `design_points` and `blend_points`.

src/type1/t1load.c

diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index c41348c..1704d13 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -751,6 +751,7 @@
         PS_DesignMap  dmap = blend->design_map + n;
 
 
+        FT_FREE( dmap->blend_points );
         FT_FREE( dmap->design_points );
         dmap->num_points = 0;
       }
@@ -1043,9 +1044,9 @@
       }
 
       /* allocate design map data */
-      if ( FT_QNEW_ARRAY( map->design_points, num_points * 2 ) )
+      if ( FT_QNEW_ARRAY( map->design_points, num_points ) ||
+           FT_QNEW_ARRAY( map->blend_points,  num_points ) )
         goto Exit;
-      map->blend_points = (FT_Fixed*)(map->design_points + num_points);
       map->num_points   = (FT_Byte)num_points;
 
       for ( p = 0; p < num_points; p++ )