Fix memory leak in harfbuzz.

This commit cherrypicks the following commit into the harfbuzz.old
repository, and also picks up a simple fix to the Tibetan shaper.

http://cgit.freedesktop.org/harfbuzz.old/commit/?id=3ab7b37bdebf0f8773493a1fee910b151c4de30f

It should fix some memory leaks observed with Arabic-family scripts.

Change-Id: I31ba3f619506e843b10360b733d36097aa22653a

4 files changed, 17 insertions, 10 deletions

diff --git a/src/harfbuzz-arabic.c b/src/harfbuzz-arabic.c
index 3837087..51f839a 100755
--- a/src/harfbuzz-arabic.c
+++ b/src/harfbuzz-arabic.c
@@ -1111,16 +1111,22 @@ HB_Bool HB_ArabicShape(HB_ShaperItem *item)
 
     if (HB_SelectScript(item, item->item.script == HB_Script_Arabic ? arabic_features : syriac_features)) {
         HB_Bool ot_ok;
-        if (arabicSyriacOpenTypeShape(item, &ot_ok))
+        if (arabicSyriacOpenTypeShape(item, &ot_ok)) {
+            HB_FREE_STACKARRAY(shapedChars);
             return TRUE;
-        if (ot_ok)
+        }
+        if (ot_ok) {
+            HB_FREE_STACKARRAY(shapedChars);
             return FALSE;
             /* fall through to the non OT code*/
+        }
     }
 #endif
 
-    if (item->item.script != HB_Script_Arabic)
+    if (item->item.script != HB_Script_Arabic) {
+        HB_FREE_STACKARRAY(shapedChars);
         return HB_BasicShape(item);
+    }
 
     shapedString(item->string, item->stringLength, item->item.pos, item->item.length, shapedChars, &slen,
                   item->item.bidiLevel % 2,
diff --git a/src/harfbuzz-gpos.c b/src/harfbuzz-gpos.c
index 7bd3b3b..e969a01 100755
--- a/src/harfbuzz-gpos.c
+++ b/src/harfbuzz-gpos.c
@@ -5171,13 +5171,13 @@ static HB_Error  Lookup_ChainContextPos2(
   if ( error )
     return error;
 
+  if (ccpf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccpf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccpf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;
diff --git a/src/harfbuzz-gsub.c b/src/harfbuzz-gsub.c
index 21fec51..ceb7034 100755
--- a/src/harfbuzz-gsub.c
+++ b/src/harfbuzz-gsub.c
@@ -3158,13 +3158,13 @@ static HB_Error  Lookup_ChainContextSubst2( HB_GSUBHeader*               gsub,
   if ( error )
     return error;
 
+  if (ccsf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccsf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccsf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccsf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;
diff --git a/src/harfbuzz-tibetan.c b/src/harfbuzz-tibetan.c
index 847ac52..be38ab2 100755
--- a/src/harfbuzz-tibetan.c
+++ b/src/harfbuzz-tibetan.c
@@ -90,7 +90,7 @@ static const unsigned char tibetanForm[0x80] = {
 
 
 #define tibetan_form(c) \
-    ((c) >= 0x0f40 && (c) <= 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
+    ((c) >= 0x0f40 && (c) < 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
 
 static const HB_OpenTypeFeature tibetan_features[] = {
     { HB_MAKE_TAG('c', 'c', 'm', 'p'), CcmpProperty },
@@ -113,6 +113,7 @@ static HB_Bool tibetan_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
 
     if (item->num_glyphs < item->item.length + 4) {
         item->num_glyphs = item->item.length + 4;
+        HB_FREE_STACKARRAY(reordered);
         return FALSE;
     }