commit 30ca63d4fb5933cad2547a73f78c25b920266d44
author Alexei Podtelezhnikov <apodtele@gmail.com> Sat Oct 16 23:02:47 2021 -0400
committer Alexei Podtelezhnikov <apodtele@gmail.com> Sat Oct 16 23:02:47 2021 -0400
tree 2696138a3edcdf66f3f8a70d03b50d72f40d1524
parent afd1cb2881a2da28edd5beb6afcf99121c6ede84

[bdf] Fix up user properties.

Fallout reported as
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40027

* src/bdf/bdflib.c (_bdf_add_property): Cosmetic NULL.
(bdf_create_property): Limit allocations to customary signed
FT_Long and NULL-initialize unused storage.
(bdf_free_font): Do not free unused storage.

src/bdf/bdflib.c

diff --git a/src/bdf/bdflib.c b/src/bdf/bdflib.c
index f2ce328..82272ce 100644
--- a/src/bdf/bdflib.c
+++ b/src/bdf/bdflib.c
@@ -852,7 +852,7 @@
     p = font->user_props + font->nuser_props;
 
     n = ft_strlen( name ) + 1;
-    if ( n > FT_ULONG_MAX )
+    if ( n > FT_LONG_MAX )
       return FT_THROW( Invalid_Argument );
 
     if ( FT_QALLOC( p->name, n ) )
@@ -860,8 +860,9 @@
 
     FT_MEM_COPY( (char *)p->name, name, n );
 
-    p->format  = format;
-    p->builtin = 0;
+    p->format     = format;
+    p->builtin    = 0;
+    p->value.atom = NULL;  /* nothing is ever stored here */
 
     n = _num_bdf_properties + font->nuser_props;
 
@@ -1181,7 +1182,7 @@
     switch ( prop->format )
     {
     case BDF_ATOM:
-      fp->value.atom = 0;
+      fp->value.atom = NULL;
       if ( value && value[0] )
       {
         if ( FT_STRDUP( fp->value.atom, value ) )
@@ -2351,11 +2352,7 @@
     /* Free up the user defined properties. */
     for ( prop = font->user_props, i = 0;
           i < font->nuser_props; i++, prop++ )
-    {
       FT_FREE( prop->name );
-      if ( prop->format == BDF_ATOM )
-        FT_FREE( prop->value.atom );
-    }
 
     FT_FREE( font->user_props );