Some free(9) sizes & fix to make wsfont_remove() compile.  This function
is #ifndef for the moment.  That's mainly for coherency and to reduce
grep noise.

ok?

Index: dev/wsfont/wsfont.c
===================================================================
RCS file: /cvs/src/sys/dev/wsfont/wsfont.c,v
retrieving revision 1.55
diff -u -p -u -1 -0 -r1.55 wsfont.c
--- dev/wsfont/wsfont.c 9 Jan 2019 11:23:32 -0000       1.55
+++ dev/wsfont/wsfont.c 23 Jun 2019 00:17:43 -0000
@@ -346,23 +346,23 @@ wsfont_rotate_ccw(struct wsdisplay_font 
 }
 
 struct wsdisplay_font *
 wsfont_rotate_internal(struct wsdisplay_font *font, int ccw)
 {
        int newstride;
        struct wsdisplay_font *newfont;
        char *newbits;
 
        /* Duplicate the existing font... */
-       newfont = malloc(sizeof *font, M_DEVBUF, M_WAITOK);
+       newfont = malloc(sizeof(*newfont), M_DEVBUF, M_WAITOK);
 
-       bcopy(font, newfont, sizeof *font);
+       bcopy(font, newfont, sizeof(*font));
        newfont->cookie = NULL;
 
        /* Allocate a buffer big enough for the rotated font. */
        newstride = (font->fontheight + 7) / 8;
        newbits = mallocarray(font->numchars, newstride * font->fontwidth,
            M_DEVBUF, M_WAITOK | M_ZERO);
 
        if (ccw)
                wsfont_rotate_ccw(font, newbits, newstride);
        else
@@ -374,22 +374,22 @@ wsfont_rotate_internal(struct wsdisplay_
        newfont->stride = newstride;
        newfont->fontwidth = font->fontheight;
        newfont->fontheight = font->fontwidth;
 
        if (wsfont_add(newfont, 0) != 0) {
                /*
                 * If we seem to have rotated this font already, drop the
                 * new one...
                 */
                free(newbits, M_DEVBUF,
-                   font->numchars * newstride * font->fontwidth);
-               free(newfont, M_DEVBUF, sizeof *font);
+                   newfont->numchars * newfont->stride * newfont->fontwidth);
+               free(newfont, M_DEVBUF, sizeof(*newfont));
                newfont = NULL;
        }
 
        return (newfont);
 }
 
 int
 wsfont_rotate(int cookie, int ccw)
 {
        int s, ncookie;
@@ -499,33 +499,32 @@ wsfont_add(struct wsdisplay_font *font, 
        }
 
        TAILQ_FOREACH(ent, &fontlist, chain)
                fontc++;
 
        if (fontc >= WSDISPLAY_MAXFONTCOUNT) {
                splx(s);
                return (-1);
        }
 
-       ent = (struct font *)malloc(sizeof *ent, M_DEVBUF, M_WAITOK);
+       ent = malloc(sizeof(*ent), M_DEVBUF, M_WAITOK);
 
        ent->lockcount = 0;
        ent->flg = 0;
        ent->cookie = cookiegen++;
 
        /*
         * If we are coming from a WSDISPLAYIO_LDFONT ioctl, we need to
         * make a copy of the wsdisplay_font struct, but not of font->bits.
         */
        if (copy) {
-               ent->font = (struct wsdisplay_font *)malloc(sizeof *ent->font,
-                   M_DEVBUF, M_WAITOK);
+               ent->font = malloc(sizeof(*ent->font), M_DEVBUF, M_WAITOK);
                memcpy(ent->font, font, sizeof(*ent->font));
                ent->flg = 0;
        } else {
                ent->font = font;
                ent->flg = WSFONT_STATIC;
        }
 
        /* Now link into the list and return */
        TAILQ_INSERT_TAIL(&fontlist, ent, chain);
        splx(s);
@@ -549,27 +548,31 @@ wsfont_remove(int cookie)
                return (-1);
        }
 
        if ((ent->flg & WSFONT_BUILTIN) != 0 || ent->lockcount != 0) {
                splx(s);
                return (-1);
        }
 
        /* Don't free statically allocated font data */
        if ((ent->flg & WSFONT_STATIC) != 0) {
-               free(ent->font->data, M_DEVBUF, 0);
-               free(ent->font, M_DEVBUF, 0);
+               struct wsdisplay_font *font = ent->font;
+
+               free(font->data, M_DEVBUF,
+                   font->numchars * font->stride * font->fontwidth);
+               free(font, M_DEVBUF, sizeof(*font));
+               ent->font = NULL;
        }
 
        /* Remove from list, free entry */
-       TAILQ_REMOVE(&list, ent, chain);
-       free(ent, M_DEVBUF, 0);
+       TAILQ_REMOVE(&fontlist, ent, chain);
+       free(ent, M_DEVBUF, sizeof(*ent));
        splx(s);
        return (0);
 }
 #endif
 
 /*
  * Lock a given font and return new lockcount. This fails if the cookie
  * is invalid, or if the font is already locked and the bit/byte order
  * requested by the caller differs.
  */

Reply via email to