Fix null HB_Device** dereference on exit in Harfbuzz GPOS code

Fix incorrect usage of _HB_OPEN_Free_Device() in CaretValue cleanup

4 files changed, 21 insertions, 17 deletions

diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
index c0c6f2c..966b167 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
@@ -462,7 +462,7 @@ static HB_Error  Load_CaretValue( HB_CaretValue*  cv,
 static void  Free_CaretValue( HB_CaretValue*  cv)
 {
   if ( cv->CaretValueFormat == 3 )
-    _HB_OPEN_Free_Device( &cv->cvf.cvf3.Device );
+    _HB_OPEN_Free_Device( cv->cvf.cvf3.Device );
 }
 
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
index 31b9ae1..0236271 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
@@ -433,13 +433,16 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
   return HB_Err_Ok;
 
 Fail1:
-  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
+  if ( vr->DeviceTables )
+    _HB_OPEN_Free_Device( vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
 
 Fail2:
-  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
+  if ( vr->DeviceTables )
+    _HB_OPEN_Free_Device( vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
 
 Fail3:
-  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
+  if ( vr->DeviceTables )
+    _HB_OPEN_Free_Device( vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
 
   FREE( vr->DeviceTables );
   return error;
@@ -450,13 +453,13 @@ static void  Free_ValueRecord( HB_ValueRecord*  vr,
 			       HB_UShort         format )
 {
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE )
-    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
+    _HB_OPEN_Free_Device( vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE )
-    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
+    _HB_OPEN_Free_Device( vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE )
-    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
+    _HB_OPEN_Free_Device( vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE )
-    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_PLACEMENT_DEVICE] );
+    _HB_OPEN_Free_Device( vr->DeviceTables[VR_X_PLACEMENT_DEVICE] );
   FREE( vr->DeviceTables );
 }
 
@@ -688,7 +691,8 @@ static HB_Error  Load_Anchor( HB_Anchor*  an,
   return HB_Err_Ok;
 
 Fail:
-  _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
+  if ( an->af.af3.DeviceTables )
+    _HB_OPEN_Free_Device( an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
 
   FREE( an->af.af3.DeviceTables );
   return error;
@@ -697,10 +701,10 @@ Fail:
 
 static void  Free_Anchor( HB_Anchor*  an)
 {
-  if ( an->PosFormat == 3 )
+  if ( an->PosFormat == 3 && an->af.af3.DeviceTables )
   {
-    _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
-    _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] );
+    _HB_OPEN_Free_Device( an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
+    _HB_OPEN_Free_Device( an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] );
     FREE( an->af.af3.DeviceTables );
   }
 }
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
index 65ca453..f1ca278 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
@@ -79,7 +79,7 @@ HB_INTERNAL void  _HB_OPEN_Free_LookupList( HB_LookupList*  ll,
 
 HB_INTERNAL void  _HB_OPEN_Free_Coverage( HB_Coverage*  c );
 HB_INTERNAL void  _HB_OPEN_Free_ClassDefinition( HB_ClassDefinition*  cd );
-HB_INTERNAL void  _HB_OPEN_Free_Device( HB_Device**  d );
+HB_INTERNAL void  _HB_OPEN_Free_Device( HB_Device*  d );
 
 
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open.c b/src/3rdparty/harfbuzz/src/harfbuzz-open.c
index adc6cec..15cd2c1 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open.c
@@ -1353,12 +1353,12 @@ _HB_OPEN_Load_Device( HB_Device** device,
 
 
 HB_INTERNAL void
-_HB_OPEN_Free_Device( HB_Device** d )
+_HB_OPEN_Free_Device( HB_Device* d )
 {
-  if ( *d )
+  if ( d )
   {
-    FREE( (*d)->DeltaValue );
-    FREE( *d );
+    FREE( d->DeltaValue );
+    FREE( d );
   }
 }