[freetype2] master 9228122: * src/truetype/ttgxvar.c (tt_done_blend): Fix deallocation.

[Werner LEMBERG]

branch: master
commit 922812281cdec91174e627760e1db0d6145e9e91
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/truetype/ttgxvar.c (tt_done_blend): Fix deallocation.
---
 ChangeLog              |    4 ++++
 src/truetype/ttgxvar.c |    7 +++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 1024f71..c11716f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2016-10-11  Werner Lemberg  <address@hidden>
+
+       * src/truetype/ttgxvar.c (tt_done_blend): Fix deallocation.
+
 2016-10-08  Werner Lemberg  <address@hidden>
 
        * src/cid/cidload.c (cid_face_open): Properly propagate `error'.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index b82b2d8..52d612e 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -2163,15 +2163,18 @@
   {
     if ( blend != NULL )
     {
-      FT_UInt  i;
+      FT_UInt  i, num_axes;
 
 
+      /* blend->num_axis might not be set up yet */
+      num_axes = blend->mmvar->num_axis;
+
       FT_FREE( blend->normalizedcoords );
       FT_FREE( blend->mmvar );
 
       if ( blend->avar_segment != NULL )
       {
-        for ( i = 0; i < blend->num_axis; i++ )
+        for ( i = 0; i < num_axes; i++ )
           FT_FREE( blend->avar_segment[i].correspondence );
         FT_FREE( blend->avar_segment );
       }