Mon 21 Aug 2017 09:19:36 PM UTC, original submission:
While debugging I noticed the memory from a ft_mem_realloc() gets
zeroed twice when called with current count 0. With non-zero current
count, the memory->realloc() callout is done but with zero current count,
ft_mem_alloc() is called instead of memory->alloc().
I downloaded and looked at version 2.8 and the ft_mem_alloc is there as well.
I did some light testing with this change and output checksums were the same.
177c177,180
< block = ft_mem_alloc( memory, new_count*item_size, &error );
---
> /block = ft_mem_alloc( memory, new_countitem_size, &error );*/
> block = memory->alloc( memory, new_count*item_size );
> if ( block == NULL )
> error = FT_THROW( Out_Of_Memory );
......
else if ( new_count > FT_INT_MAX/item_size )
{
error = FT_THROW( Array_Too_Large );
}
else if ( cur_count == 0 )
{
FT_ASSERT( block == NULL );
block = ft_mem_alloc( memory, new_count*item_size, &error ); <--- causes double zeroing
}
else
{
FT_Pointer block2;
FT_Long cur_size = cur_count*item_size;
FT_Long new_size = new_count*item_size;
block2 = memory->realloc( memory, cur_size, new_size, block );
if ( block2 == NULL )
error = FT_THROW( Out_Of_Memory );
else
block = block2;
}
#7 0x082061bb in FRSAlloc (pPDIstate=0xefc126f8, size=1104, file=0x888bf50 "../freetype2/ftsystem.c", line=132) at ../pdi/fntsockt.c:506
#8 0x08299193 in ft_alloc (memory=0xefc14f18, size=1104) at ../freetype2/ftsystem.c:132
#9 0x08254162 in ft_mem_qalloc (memory=0xefc14f18, size=1104, p_error=0xffffc288) at ../freetype2/ftutil.c:108
#10 0x082540fc in ft_mem_alloc (memory=0xefc14f18, size=1104, p_error=0xffffc2b0) at ../freetype2/ftutil.c:87
^^^^^^^^^^^ Zeros memory it gets from ft_mem_qalloc()
#11 0x082543d4 in ft_mem_qrealloc (memory=0xefc14f18, item_size=92, cur_count=0, new_count=12, block=0x0, p_error=0xffffc2fc) at
^^^^^^^^^^^^^^ Since this doesn't call ft_alloc() directly, memory is zeroed twice.
../freetype2/ftutil.c:294
#12 0x082541ff in ft_mem_realloc (memory=0xefc14f18, item_size=92, cur_count=0, new_count=12, block=0x0, p_error=0xffffc374) at
^^^^^^^^^^^ Zeros memory it gets from ft_mem_qrealloc()
|