Don't attempt to copy anchors into NULL font #5405
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Any time
SFDDumpUndo()orSFDGetUndo()are run, they end up callingSplineCharCopy()withNULLfor theSplineFont *intoparameter. When this happens,SplineCharCopy()attempts to copy the anchors into the new SplineChar'sparentfont, but since that is set toNULLit crashes whenAnchorPointsDuplicate()attempts to read fromsc->parent->anchor.Because
SFDDumpUndo()andSFDGetUndo()appear to only do this so that they can have a copy of the character's hints at a given undo state (and then copy thoes hints into or out of the .sfd file), never affect anchor classes, and delete the parentless SplineChar immediately after, I've determined that it's safe to simply not duplicate the AnchorPoints whenintois set toNULL.To do this, instead of setting
nsc->anchorto the output returned byAnchorPointsDuplicate(), I use a ternary statement to detect whether or notintois NULL. If it is, thennsc->anchoris set to NULL, and otherwise the value returned byAnchorPointsDuplicate()is used. I decided not to do the reverse (which could have made the code shorter) simply because line 505 already includes a similar ternary statement that checks ifintoisNULL, and I decided to use the same format.This fixes #5130, and is a slightly more elegant variation of the same fix that I had proposed back then (more elegant because I skip the entire
AnchorPointsDuplicate()function call instead of merely skipping over the loop that makes up the majority of the function). I don't see a reason for this to be functionally any different from the originally proposed solution, and I've extensively used FontForge with that change made with no furtherAnchorPointcrashes.A more 'proper' fix would probably include systematic changes to how hint undoes are saved and loaded from SFD files, but that's beyond my skill and, quite honestly, not something I even care about that much. That code appears to work despite it's oddities, and simply checking if
into==NULLbefore doing anything with theAnchorPointsallows all the hint-related stuff thatSplineCharCopy()does continue to work for the sake of bothSFDDumpUndo()andSFDGetUndo().Type of change
Fixes FontForge crashes when a font has anchor classes, and you perform bulk operations on the font (such as changing the EM size) #5130