[OpenJDK 2D-Dev] RFR:  JDK-8132985, , Crash in freetypescaler.c due to double free
prasanta.sadhukhan at oracle.com
Mon Sep 21 09:27:30 UTC 2015
Please review a bug fix whereby freeing a FT_StreamRec pointer leads to
It was found that FT_Done_Face() frees the FT_StreamRec pointer if FT
allocated memory for it internally.
Since Java uses freetype, FT ends up allocating FT_StreamRec structure
in Java's TypeFont1. We call FT_Done_Face(FT_Face)
and also free(face->stream) resulting in double free causing crash.
The solution is to maintain it's own copy of stream pointer so Java
knows when it needs to free the stream pointer and when to
leave it to FT.
More information about the 2d-dev