prevent double-free error caused by redundant contour label font

Ethan A Merritt · Ethan A Merritt · commit dadb35815df0 · 2019-03-21T20:09:36.000-07:00
The font used for contour labels is taken from 'set cntrlabel font'.
For some reason providing an explicit font in the splot command
causes a double-free during cleanup.  Since this font would not be
used anyway, clear it before it can cause any damage.
Bug #2154
diff --git a/src/graph3d.c b/src/graph3d.c
@@ -1439,7 +1439,6 @@ do_3dplot(
 			    free(thiscontour_label);
 			    thiscontour_label = gp_strdup(c);
 			}
-			/* cntr3d_lines(cntrs, &thiscontour_lp_properties); */
 			cntr3d_labels(cntrs, thiscontour_label, this_plot->labels);
 			break;
 
@@ -2153,6 +2152,7 @@ cntr3d_labels(struct gnuplot_contours *cntr, char *level_text, struct text_label
 		continue;
 	    map3d_xy(cntr->coords[i].x, cntr->coords[i].y, base_z, &x, &y);
 	    label->text = level_text;
+	    label->font = clabel_font;
 	    if (hidden3d) {
 		map3d_xyz(cntr->coords[i].x, cntr->coords[i].y, base_z, &v);
 		v.real_z = cntr->coords[i].z;
@@ -2162,6 +2162,7 @@ cntr3d_labels(struct gnuplot_contours *cntr, char *level_text, struct text_label
 		write_label(x, y, label);
 	    }
 	    label->text = NULL;		/* Otherwise someone will try to free it */
+	    label->font = NULL;
 	}
     }
 }
diff --git a/src/plot3d.c b/src/plot3d.c
@@ -2020,6 +2020,14 @@ eval_3dplots()
 		    this_plot->lp_properties.p_size = 1;
 	    }
 
+	    /* FIXME: Leaving an explicit font in the label style for contour */
+	    /* labels causes a double-free segfault.  Clear it preemptively.  */
+	    if (this_plot->plot_style == LABELPOINTS
+	    &&  (draw_contour && !this_plot->opt_out_of_contours)) {
+		free(this_plot->labels->font);
+		this_plot->labels->font = NULL;
+	    }
+
 	    if (crnt_param == 0
 		&& this_plot->plot_style != PM3DSURFACE
 		/* don't increment the default line/point properties if
@@ -2695,8 +2703,6 @@ parametric_3dfixup(struct surface_points *start_plot, int *plot_num)
 static void load_contour_label_options (struct text_label *contour_label)
 {
     struct lp_style_type *lp = &(contour_label->lp_properties);
-    if (!contour_label->font)
-	contour_label->font = gp_strdup(clabel_font);
     lp->p_interval = clabel_interval;
     lp->flags |= LP_SHOW_POINTS;
     lp_parse(lp, LP_ADHOC, TRUE);

Original file line number	Diff line number	Diff line change
`@@ -1439,7 +1439,6 @@ do_3dplot(`
`1439`	`1439`	`free(thiscontour_label);`
`1440`	`1440`	`thiscontour_label = gp_strdup(c);`
`1441`	`1441`	`}`
`1442`		`- /* cntr3d_lines(cntrs, &thiscontour_lp_properties); */`
`1443`	`1442`	`cntr3d_labels(cntrs, thiscontour_label, this_plot->labels);`
`1444`	`1443`	`break;`
`1445`	`1444`
`@@ -2153,6 +2152,7 @@ cntr3d_labels(struct gnuplot_contours cntr, char level_text, struct text_label`
`2153`	`2152`	`continue;`
`2154`	`2153`	`map3d_xy(cntr->coords[i].x, cntr->coords[i].y, base_z, &x, &y);`
`2155`	`2154`	`label->text = level_text;`
	`2155`	`+ label->font = clabel_font;`
`2156`	`2156`	`if (hidden3d) {`
`2157`	`2157`	`map3d_xyz(cntr->coords[i].x, cntr->coords[i].y, base_z, &v);`
`2158`	`2158`	`v.real_z = cntr->coords[i].z;`
`@@ -2162,6 +2162,7 @@ cntr3d_labels(struct gnuplot_contours cntr, char level_text, struct text_label`
`2162`	`2162`	`write_label(x, y, label);`
`2163`	`2163`	`}`
`2164`	`2164`	`label->text = NULL; /* Otherwise someone will try to free it */`
	`2165`	`+ label->font = NULL;`
`2165`	`2166`	`}`
`2166`	`2167`	`}`
`2167`	`2168`	`}`