From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from post.mail.demon.net ([194.217.242.40]) by hawkwind.utcs.utoronto.ca with SMTP id <24851>; Thu, 17 Sep 1998 02:29:59 -0400
Received: from [212.228.106.206] (helo=kremvax.demon.co.uk)
	by post.mail.demon.net with esmtp (Exim 2.02 #1)
	id 0zJ4wT-0001xm-00; Tue, 15 Sep 1998 23:55:34 +0000
Received: (from mhw@localhost)
	by kremvax.demon.co.uk (8.8.7/8.8.7) id AAA29001;
	Wed, 16 Sep 1998 00:18:51 +0100
To:	bobf@research.bell-labs.com
cc:	sam-fans@hawkwind.utcs.toronto.edu
Subject: libXg bug fix
From:	"Mark H. Wilkinson" <mhw@kremvax.demon.co.uk>
Date:	Tue, 15 Sep 1998 19:03:28 -0400
Message-ID: <199809160003.28896.out.badoz@kremvax.demon.co.uk>
X-Face: Bsp[Ds(Y#/{==j:Cv'"IK4R^D0_z]{'OYtp2^EYqpG)88Cs<UL+zniMXRf590$K}2n!MWs1
 5AQ1_Fgao4GJ9b+sb{Mauu/aL."H";YYnQ6HYpA.NM:yvTD>dBm&LJ{idLZWx}AKf}E4#|@4DT4cX3
 ?!>aIVcxmd#1

This fixes a bug in ffree() in sam's libXg. c is a pointer to a
structure within an array of such structures, and as such shouldn't
be free'd. The later call to free(f->subf) frees the whole array.

I should point out that sam doesn't actually call ffree() anywhere,
so it's not going to fall over because of this. Other programs might.

-Mark.

Index: rdfontfile.c
===================================================================
RCS file: /u/cvs/9libs/libXg/rdfontfile.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -C4 -r1.4 -r1.5
*** rdfontfile.c	1998/08/11 00:20:44	1.4
--- rdfontfile.c	1998/09/15 23:03:22	1.5
***************
*** 126,134 ****
  		c = f->subf+i;
  		if (c->f)
  			subffree(c->f);
  		free(c->name);
- 		free(c);
  	}
  	free(f->subf);
  	free(f);
  }
--- 126,133 ----