The ProcRenderAddGlyphs function calls the AllocateGlyph function to store new glyphs sent by the client to the X server. AllocateGlyph would return a new glyph with refcount=0 and a re-used glyph would end up not changing the refcount at all. The resulting glyph_new array would thus have multiple entries pointing to the same non-refcounted glyphs.ProcRenderAddGlyphs may free a glyph, resulting in a use-after-free when the same glyph pointer is then later used