summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTor Andersson <tor.andersson@artifex.com>2020-06-03 18:10:43 +0200
committerTor Andersson <tor.andersson@artifex.com>2020-06-05 20:05:08 +0200
commit8719e07834d6a72b6b4131539e49ed1e8e2ff79e (patch)
tree5e5bca642ceb8df266bc6e47d2093de55d9fdb1a
parent541d82ca29365e0225ed0bb7e1cb7b2c0b82225e (diff)
Bug 701295: Fix use of stale pointer after realloc.
fz_run_t3_glyph may cause recursion, which means that svg_dev_text_span_as_path_defs needs to be re-entrant at that point. Recalculate the 'fnt' pointer from the sdev->fonts array after calling a function that may trigger an array realloc.
-rw-r--r--source/fitz/svg-device.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/source/fitz/svg-device.c b/source/fitz/svg-device.c
index 88f8cfbd4..0130cadc9 100644
--- a/source/fitz/svg-device.c
+++ b/source/fitz/svg-device.c
@@ -494,6 +494,7 @@ svg_dev_text_span_as_paths_defs(fz_context *ctx, fz_device *dev, fz_text_span *s
shift.e = -rect.x0;
shift.f = -rect.y0;
fz_run_t3_glyph(ctx, span->font, gid, shift, dev);
+ fnt = &sdev->fonts[font_idx]; /* recursion may realloc the font array! */
}
fz_write_printf(ctx, out, "</symbol>\n");
out = end_def(ctx, sdev);