[Fontconfig] Possible memory problem

[Patrick Lam]

Behdad Esfahbod wrote:
> *** glibc detected *** /usr/lib/firefox-1.0.7/firefox-bin:
> free(): invalid pointer: 0x0a02d080 ***

I think that this patch ought to fix the problem:
Index: src/fcpat.c
===================================================================
RCS file: /cvs/fontconfig/fontconfig/src/fcpat.c,v
retrieving revision 1.27.2.27
diff -u -p -r1.27.2.27 fcpat.c
--- src/fcpat.c 29 Nov 2005 06:09:18 -0000  1.27.2.27
+++ src/fcpat.c 5 Dec 2005 06:57:09 -0000
@@ -36,6 +36,8 @@ static int fcvaluelist_bank_count = 0, f

  static FcPatternEltPtr
  FcPatternEltPtrCreateDynamic (FcPatternElt * e);
+static FcBool
+FcStrHashed (const FcChar8 *name);

  static const char *
  FcPatternFindFullFname (const FcPattern *p);
@@ -69,7 +71,8 @@ FcValueDestroy (FcValue v)
  {
      switch (v.type) {
      case FcTypeString:
- FcStrFree ((FcChar8 *) v.u.s);
+        if (!FcStrHashed (v.u.s))
+            FcStrFree ((FcChar8 *) v.u.s);
   break;
      case FcTypeMatrix:
   FcMatrixFree ((FcMatrix *) v.u.m);
@@ -150,7 +153,8 @@ FcValueListDestroy (FcValueListPtr l)
      {
   switch (FcValueListPtrU(l)->value.type) {
   case FcTypeString:
-     FcStrFree ((FcChar8 *)FcValueListPtrU(l)->value.u.s);
+            if (!FcStrHashed ((FcChar8 *)FcValueListPtrU(l)->value.u.s))
+                FcStrFree ((FcChar8 *)FcValueListPtrU(l)->value.u.s);
       break;
   case FcTypeMatrix:
       FcMatrixFree ((FcMatrix *)FcValueListPtrU(l)->value.u.m);
@@ -1365,6 +1369,19 @@ static struct objectBucket {
      FcChar32           hash;
  } *FcObjectBuckets[OBJECT_HASH_SIZE];

+static FcBool
+FcStrHashed (const FcChar8 *name)
+{
+    FcChar32           hash = FcStringHash (name);
+    struct objectBucket        **p;
+    struct objectBucket        *b;
+
+    for (p = &FcObjectBuckets[hash % OBJECT_HASH_SIZE]; (b = *p); p = 
&(b->next))
+ if (b->hash == hash && !strcmp ((char *)name, (char *) (b + 1)))
+            return FcTrue;
+    return FcFalse;
+}
+
  const FcChar8 *
  FcStrStaticName (const FcChar8 *name)
  {

Please test it; if it works, I'll commit it.

pat