freetype: Fix a possible buffer corruption

Memory associated with a FcPattern is freed when the pattern is
destroyed, so copying the font filename needs to be done before
the call to FcPatternDestroy.
Signed-off-by: Thierry Reding <thierry.reding@avionic-design.de>
Modified-by: Rafaël Carré <funman@videolan.org> (simplify return)
Signed-off-by: Rafaël Carré <funman@videolan.org>
(cherry picked from commit ae3fd8273b0a16b6ab7f17e119b5d1beb79f4a14)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

modules/text_renderer/freetype.c

@@ -505,6 +505,7 @@ static char* FontConfig_Select( FcConfig* config, const char* family,
     FcPattern *pat, *p_pat;
     FcChar8* val_s;
     FcBool val_b;
+    char *ret = NULL;
 
     /* Create a pattern and fills it */
     pat = FcPatternCreate();
@@ -561,14 +562,11 @@ static char* FontConfig_Select( FcConfig* config, const char* family,
                             "the requested one: '%s' != '%s'\n",
                             (const char*)val_s, family );   */
 
-    if( FcResultMatch != FcPatternGetString( p_pat, FC_FILE, 0, &val_s ) )
-    {
-        FcPatternDestroy( p_pat );
-        return NULL;
-    }
+    if( FcResultMatch == FcPatternGetString( p_pat, FC_FILE, 0, &val_s ) )
+        ret = strdup( (const char*)val_s );
 
     FcPatternDestroy( p_pat );
-    return strdup( (const char*)val_s );
+    return ret;
 }
 #endif