From a5218a7330cb14ddd9afa323ab03f4334e6a77a0 Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Sun, 19 Nov 2023 16:25:45 +0100 Subject: patch 9.0.2118: [security]: avoid double-free in get_style_font_variants Problem: [security]: avoid double-free Solution: Only fee plain_font, when it is not the same as bold_font When plain_font == bold_font and bold_font is not NULL, we may end up trying to free bold_font again, which already has been freed a few lines above. So only free bold_font, when the condition gui.font_can_bold is true, which means that bold_font is not pointing to plain_font (so it needs to be freed separately). Signed-off-by: Christian Brabandt --- src/gui_gtk_x11.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/gui_gtk_x11.c') diff --git a/src/gui_gtk_x11.c b/src/gui_gtk_x11.c index 4b3f53ef91..87838b9488 100644 --- a/src/gui_gtk_x11.c +++ b/src/gui_gtk_x11.c @@ -5048,7 +5048,8 @@ get_styled_font_variants(void) } pango_font_description_free(bold_font_desc); - g_object_unref(plain_font); + if (bold_font != NULL && gui.font_can_bold) + g_object_unref(plain_font); } static PangoEngineShape *default_shape_engine = NULL; -- cgit v1.2.3