diff options
| author | Tor Andersson <tor.andersson@artifex.com> | 2020-06-03 18:10:43 +0200 |
|---|---|---|
| committer | Tor Andersson <tor.andersson@artifex.com> | 2020-06-05 20:05:08 +0200 |
| commit | 8719e07834d6a72b6b4131539e49ed1e8e2ff79e (patch) | |
| tree | 5e5bca642ceb8df266bc6e47d2093de55d9fdb1a | |
| parent | 541d82ca29365e0225ed0bb7e1cb7b2c0b82225e (diff) | |
Bug 701295: Fix use of stale pointer after realloc.
fz_run_t3_glyph may cause recursion, which means that
svg_dev_text_span_as_path_defs needs to be re-entrant at that point.
Recalculate the 'fnt' pointer from the sdev->fonts array after calling
a function that may trigger an array realloc.
| -rw-r--r-- | source/fitz/svg-device.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/source/fitz/svg-device.c b/source/fitz/svg-device.c index 88f8cfbd4..0130cadc9 100644 --- a/source/fitz/svg-device.c +++ b/source/fitz/svg-device.c @@ -494,6 +494,7 @@ svg_dev_text_span_as_paths_defs(fz_context *ctx, fz_device *dev, fz_text_span *s shift.e = -rect.x0; shift.f = -rect.y0; fz_run_t3_glyph(ctx, span->font, gid, shift, dev); + fnt = &sdev->fonts[font_idx]; /* recursion may realloc the font array! */ } fz_write_printf(ctx, out, "</symbol>\n"); out = end_def(ctx, sdev); |
