commit d124f9692dc8dad8f5f77c293fe6d4ec1a0c02ea
author Raph Levien <raph@google.com> Mon Jul 30 13:34:29 2012 -0700
committer Raph Levien <raph@google.com> Mon Jul 30 13:34:29 2012 -0700
tree efc21579bcb05052f9b205f620fc23e6dbd4be0b
parent 81da29ac61d5854976e515f6fede6a418b8eaec4

Fix memory leak in harfbuzz.

This commit cherrypicks the following commit into the harfbuzz.old
repository, and also picks up a simple fix to the Tibetan shaper.

http://cgit.freedesktop.org/harfbuzz.old/commit/?id=3ab7b37bdebf0f8773493a1fee910b151c4de30f

It should fix some memory leaks observed with Arabic-family scripts.

Change-Id: I31ba3f619506e843b10360b733d36097aa22653a

src/harfbuzz-arabic.c

diff --git a/src/harfbuzz-arabic.c b/src/harfbuzz-arabic.c
index 3837087..51f839a 100755
--- a/src/harfbuzz-arabic.c
+++ b/src/harfbuzz-arabic.c
@@ -1111,16 +1111,22 @@
 
     if (HB_SelectScript(item, item->item.script == HB_Script_Arabic ? arabic_features : syriac_features)) {
         HB_Bool ot_ok;
-        if (arabicSyriacOpenTypeShape(item, &ot_ok))
+        if (arabicSyriacOpenTypeShape(item, &ot_ok)) {
+            HB_FREE_STACKARRAY(shapedChars);
             return TRUE;
-        if (ot_ok)
+        }
+        if (ot_ok) {
+            HB_FREE_STACKARRAY(shapedChars);
             return FALSE;
             /* fall through to the non OT code*/
+        }
     }
 #endif
 
-    if (item->item.script != HB_Script_Arabic)
+    if (item->item.script != HB_Script_Arabic) {
+        HB_FREE_STACKARRAY(shapedChars);
         return HB_BasicShape(item);
+    }
 
     shapedString(item->string, item->stringLength, item->item.pos, item->item.length, shapedChars, &slen,
                   item->item.bidiLevel % 2,

src/harfbuzz-gpos.c

diff --git a/src/harfbuzz-gpos.c b/src/harfbuzz-gpos.c
index 7bd3b3b..e969a01 100755
--- a/src/harfbuzz-gpos.c
+++ b/src/harfbuzz-gpos.c
@@ -5171,13 +5171,13 @@
   if ( error )
     return error;
 
+  if (ccpf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccpf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccpf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;

src/harfbuzz-gsub.c

diff --git a/src/harfbuzz-gsub.c b/src/harfbuzz-gsub.c
index 21fec51..ceb7034 100755
--- a/src/harfbuzz-gsub.c
+++ b/src/harfbuzz-gsub.c
@@ -3158,13 +3158,13 @@
   if ( error )
     return error;
 
+  if (ccsf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccsf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccsf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccsf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;

src/harfbuzz-tibetan.c

diff --git a/src/harfbuzz-tibetan.c b/src/harfbuzz-tibetan.c
index 847ac52..be38ab2 100755
--- a/src/harfbuzz-tibetan.c
+++ b/src/harfbuzz-tibetan.c
@@ -90,7 +90,7 @@
 
 
 #define tibetan_form(c) \
-    ((c) >= 0x0f40 && (c) <= 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
+    ((c) >= 0x0f40 && (c) < 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
 
 static const HB_OpenTypeFeature tibetan_features[] = {
     { HB_MAKE_TAG('c', 'c', 'm', 'p'), CcmpProperty },
@@ -113,6 +113,7 @@
 
     if (item->num_glyphs < item->item.length + 4) {
         item->num_glyphs = item->item.length + 4;
+        HB_FREE_STACKARRAY(reordered);
         return FALSE;
     }