Fix ftfont_open2 failure cleanup

* src/ftfont.c (ftfont_open2): Don’t increment counter if failing.
Avoid use-after-free once the increment bug is fixed.

diff --git a/src/ftfont.c b/src/ftfont.c
index 9a8777ef078a660d7fc4d4e4f7b8815cf78f3245..a53467000f35159d9fd6f9b5145449c2555b06ea 100644 (file)
--- a/src/ftfont.c
+++ b/src/ftfont.c
@@ -1131,16 +1131,19 @@ ftfont_open2 (struct frame *f,
          return Qnil;
        }
     }
-  set_save_integer (val, 1, XSAVE_INTEGER (val, 1) + 1);
   size = XINT (AREF (entity, FONT_SIZE_INDEX));
   if (size == 0)
     size = pixel_size;
   if (FT_Set_Pixel_Sizes (ft_face, size, size) != 0)
     {
       if (XSAVE_INTEGER (val, 1) == 0)
-       FT_Done_Face (ft_face);
+       {
+         FT_Done_Face (ft_face);
+         cache_data->ft_face = NULL;
+       }
       return Qnil;
     }
+  set_save_integer (val, 1, XSAVE_INTEGER (val, 1) + 1);
 
   ASET (font_object, FONT_FILE_INDEX, filename);
   font = XFONT_OBJECT (font_object);