Bug 3029 - Double free of cairo_simple_font_face_t
Summary: Double free of cairo_simple_font_face_t
Status: VERIFIED FIXED
Alias: None
Product: cairo
Classification: Unclassified
Component: freetype font backend (show other bugs)
Version: 0.9.3
Hardware: x86 (IA32) Linux (All)
: high normal
Assignee: Owen Taylor
QA Contact: cairo-bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-04-14 05:19 UTC by Carl Worth
Modified: 2005-08-22 00:14 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments

Description Carl Worth 2005-04-14 05:19:59 UTC
If a cairo_simple_font_face_t has been created, but never been used,
(so unreferenced by any cairo_ft_unscaled_font_t), then cairo attempts
to free the cairo_simple_font_face_t twice.

The two free calls appear in the code as:

    cairo_font_face_destroy: font_face->backend->destroy (font_face);
        _cairo_simple_font_face_destroy: free (simple_face);
    cairo_font_face_destroy: free (font_face);

I won't pretend to understand the mutual reference problem, (or solution),
well enough to attempt a fix here.

See cairo/test/select-font-no-show-text.c for a simple test case that
exercises the bug.
Comment 1 Owen Taylor 2005-04-14 06:07:31 UTC
Actually, it was something really trivial ... I just forgot to
update cairo_simple_font_face_t when I moved freeing the structure
from the backend to the wrapper code.

The reason this test case excercises it is that the font doesn't
get added to any caches so it is freed immediately.

2005-04-14  Owen Taylor  <otaylor@redhat.com>

        * src/cairo-font.c (_cairo_simple_font_face_destroy): Remove
        a stray free() (#3029, Carl Worth)

        * test/select-font-no-show-text.c: Note that the bug is fixed.
Comment 2 Carl Worth 2005-04-14 06:35:32 UTC
Ah, OK.

All the talk of mutual referencing and resurrection left me to unsure to see
the easy fix.

Thanks for the quick fix.
Comment 3 Carl Worth 2005-08-22 17:14:55 UTC
Move bugs against "cvs" version to "0.9.3" so we can remove the "cvs" version.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.