Harfbuzz: backporting fixes from upstream

81c8ef785b079980ad5b46be4fe7c7bf156dbf65 Fix crash!
81f2ecafa19b602f950df5a9e6e1b99c4b5ea55e Bug 30319
ff0612c2e7df1b86fc702c72e3015a6a5ae39b4c and
2dbd0fd11799c18bb6c66e337c3e31a1419823d4 Fix OOB access possibility
3bebe289aace6daa84b3d6983cebf5c58ddfad78 Fix problem with Indic shaper and control chars
90138e5a4d15c44f05456f90083ecacdc3196c8e Fix bad memory access in Myanmar shaper
b847f24ce855d24f6822bcd9c0006905e81b94d8 Fix Arabic cursive positioning
3ab7b37bdebf0f8773493a1fee910b151c4de30f Fix misc leaks

Change-Id: I6f3a6253782bff6abe4bf741d11c09fdd67542db
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

7 files changed, 26 insertions, 14 deletions

diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c b/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c
index 0293a5dadf..660939415b 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c
@@ -1114,16 +1114,22 @@ HB_Bool HB_ArabicShape(HB_ShaperItem *item)
 
     if (HB_SelectScript(item, item->item.script == HB_Script_Arabic ? arabic_features : syriac_features)) {
         HB_Bool ot_ok;
-        if (arabicSyriacOpenTypeShape(item, &ot_ok))
+        if (arabicSyriacOpenTypeShape(item, &ot_ok)) {
+            HB_FREE_STACKARRAY(shapedChars);
             return TRUE;
-        if (ot_ok)
+        }
+        if (ot_ok) {
+            HB_FREE_STACKARRAY(shapedChars);
             return FALSE;
             /* fall through to the non OT code*/
+        }
     }
 #endif
 
-    if (item->item.script != HB_Script_Arabic)
+    if (item->item.script != HB_Script_Arabic) {
+        HB_FREE_STACKARRAY(shapedChars);
         return HB_BasicShape(item);
+    }
 
     shapedString(item->string, item->stringLength, item->item.pos, item->item.length, shapedChars, &slen,
                   item->item.bidiLevel % 2,
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
index 21ffe84ab3..1e1b92b010 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
@@ -3193,6 +3193,9 @@ static HB_Error  Lookup_MarkMarkPos( GPOS_Instance*    gpi,
     j--;
   }
 
+  if ( i > buffer->in_pos )
+    return HB_Err_Not_Covered;
+
   error = _HB_OPEN_Coverage_Index( &mmp->Mark2Coverage, IN_GLYPH( j ),
 			  &mark2_index );
   if ( error )
@@ -5349,13 +5352,13 @@ static HB_Error  Lookup_ChainContextPos2(
   if ( error )
     return error;
 
+  if (ccpf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccpf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccpf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c
index 9b6b59875a..89875d1d24 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c
@@ -3158,13 +3158,13 @@ static HB_Error  Lookup_ChainContextSubst2( HB_GSUBHeader*               gsub,
   if ( error )
     return error;
 
+  if (ccsf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccsf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccsf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccsf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
index 021d1ff4ae..31026829dd 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
@@ -37,7 +37,7 @@ static HB_Bool isLetter(HB_UChar16 ucs)
                      FLAG(HB_Letter_Titlecase) |
                      FLAG(HB_Letter_Modifier) |
                      FLAG(HB_Letter_Other);
-    return (FLAG(HB_GetUnicodeCharCategory(ucs)) &  test) != 0;
+    return !!(FLAG(HB_GetUnicodeCharCategory(ucs)) & test);
 }
 
 static HB_Bool isMark(HB_UChar16 ucs)
@@ -45,7 +45,7 @@ static HB_Bool isMark(HB_UChar16 ucs)
     const int test = FLAG(HB_Mark_NonSpacing) |
                      FLAG(HB_Mark_SpacingCombining) |
                      FLAG(HB_Mark_Enclosing);
-    return FLAG(HB_GetUnicodeCharCategory(ucs)) & test;
+    return !!(FLAG(HB_GetUnicodeCharCategory(ucs)) & test);
 }
 
 enum Form {
@@ -1683,6 +1683,7 @@ static bool indic_shape_syllable(HB_Bool openType, HB_ShaperItem *item, bool inv
                 }
                 item->glyphs[j] = item->glyphs[i];
                 item->attributes[j] = item->attributes[i];
+                item->offsets[j] = item->offsets[i];
                 item->advances[j] = item->advances[i];
                 ++i;
                 ++j;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c b/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c
index 14a963a540..91a353f5c0 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c
@@ -359,7 +359,8 @@ static HB_Bool myanmar_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
         if (kinzi >= 0 && i > base && (cc & Mymr_CF_AFTER_KINZI)) {
             reordered[len] = Mymr_C_NGA;
             reordered[len+1] = Mymr_C_VIRAMA;
-            properties[len-1] = AboveForm;
+            if (len > 0)
+                properties[len-1] = AboveForm;
             properties[len] = AboveForm;
             len += 2;
             kinzi = -1;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
index 70efc76d7e..4ffaaee235 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
@@ -1033,7 +1033,7 @@ HB_Bool HB_OpenTypePosition(HB_ShaperItem *item, int availableGlyphs, HB_Bool do
                 adjustment = HB_FIXED_ROUND(adjustment);
 
             if (positions[i].new_advance) {
-                advances[i] = adjustment;
+                ; //advances[i] = adjustment;
             } else {
                 advances[i] += adjustment;
             }
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c b/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c
index b745f22332..7dc4cebfb2 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c
@@ -90,7 +90,7 @@ static const unsigned char tibetanForm[0x80] = {
 
 
 #define tibetan_form(c) \
-    (TibetanForm)tibetanForm[c - 0x0f40]
+    ((c) >= 0x0f40 && (c) < 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
 
 #ifndef NO_OPENTYPE
 static const HB_OpenTypeFeature tibetan_features[] = {
@@ -115,6 +115,7 @@ static HB_Bool tibetan_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
 
     if (item->num_glyphs < item->item.length + 4) {
         item->num_glyphs = item->item.length + 4;
+        HB_FREE_STACKARRAY(reordered);
         return FALSE;
     }