fix use after free in font caching algorithm

[st.git] / x.c

diff --git a/x.c b/x.c
index 865dacc..2cd76d0 100644 (file)
--- a/x.c
+++ b/x.c
@@ -226,8 +226,9 @@ typedef struct {
 } Fontcache;
 
 /* Fontcache is an array now. A new font will be appended to the array. */
-static Fontcache frc[16];
+static Fontcache *frc = NULL;
 static int frclen = 0;
+static int frccap = 0;
 static char *usedfont = NULL;
 static double usedfontsize = 0;
 static double defaultfontsize = 0;
@@ -1244,12 +1245,14 @@ xmakeglyphfontspecs(XftGlyphFontSpec *specs, const Glyph *glyphs, int len, int x
                                        fcpattern, &fcres);
 
                        /*
-                        * Overwrite or create the new cache entry.
+                        * Allocate memory for the new cache entry.
                         */
-                       if (frclen >= LEN(frc)) {
-                               frclen = LEN(frc) - 1;
-                               XftFontClose(xw.dpy, frc[frclen].font);
-                               frc[frclen].unicodep = 0;
+                       if (frclen >= frccap) {
+                               frccap += 16;
+                               if (!frc)
+                                       frc = xmalloc(frccap * sizeof(Fontcache));
+                               else
+                                       frc = xrealloc(frc, frccap * sizeof(Fontcache));
                        }
 
                        frc[frclen].font = XftFontOpenPattern(xw.dpy,