From: Paul Eggert <eggert@cs.ucla.edu>
Date: Fri, 8 Jun 2018 01:53:26 +0000 (-0700)
Subject: Fix ftfont_open2 failure cleanup
X-Git-Tag: emacs-27.0.90~4920
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=4d176b742774670c5c265a06f742e63a43f5f7ab;p=emacs.git

Fix ftfont_open2 failure cleanup

* src/ftfont.c (ftfont_open2): Don’t increment counter if failing.
Avoid use-after-free once the increment bug is fixed.
---

diff --git a/src/ftfont.c b/src/ftfont.c
index 9a8777ef078..a53467000f3 100644
--- a/src/ftfont.c
+++ b/src/ftfont.c
@@ -1131,16 +1131,19 @@ ftfont_open2 (struct frame *f,
 	  return Qnil;
 	}
     }
-  set_save_integer (val, 1, XSAVE_INTEGER (val, 1) + 1);
   size = XINT (AREF (entity, FONT_SIZE_INDEX));
   if (size == 0)
     size = pixel_size;
   if (FT_Set_Pixel_Sizes (ft_face, size, size) != 0)
     {
       if (XSAVE_INTEGER (val, 1) == 0)
-	FT_Done_Face (ft_face);
+	{
+	  FT_Done_Face (ft_face);
+	  cache_data->ft_face = NULL;
+	}
       return Qnil;
     }
+  set_save_integer (val, 1, XSAVE_INTEGER (val, 1) + 1);
 
   ASET (font_object, FONT_FILE_INDEX, filename);
   font = XFONT_OBJECT (font_object);