From: Michael Jerris <mike@jerris.com>
Date: Fri, 5 Jun 2015 22:57:06 +0000 (-0500)
Subject: FS-7613: fix use after free error in switch_img_txt_handle_render
X-Git-Tag: v1.6.2~546
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=90bae91af71f14c41f7eb07f14b4933432efaeeb;p=thirdparty%2Ffreeswitch.git

FS-7613: fix use after free error in switch_img_txt_handle_render
---

diff --git a/src/switch_core_video.c b/src/switch_core_video.c
index 61fa8fae96..212267f46d 100644
--- a/src/switch_core_video.c
+++ b/src/switch_core_video.c
@@ -822,6 +822,7 @@ SWITCH_DECLARE(uint32_t) switch_img_txt_handle_render(switch_img_txt_handle_t *h
 	FT_Face face;
 	uint32_t width = 0;
 	int this_x = 0, last_x = 0, space = 0;
+	uint32_t ret;
 
 	if (zstr(text)) return 0;
 
@@ -920,9 +921,11 @@ SWITCH_DECLARE(uint32_t) switch_img_txt_handle_render(switch_img_txt_handle_t *h
 		pen.y += slot->advance.y >> 6;
 	}
 
+	ret = width + slot->bitmap.width * 3;
+
 	FT_Done_Face(face);
 
-	return width + slot->bitmap.width * 3;
+	return ret;
 #else
 	return 0;
 #endif