Harfbuzz: backporting fixes from upstream

81c8ef785b079980ad5b46be4fe7c7bf156dbf65 Fix crash!
81f2ecafa19b602f950df5a9e6e1b99c4b5ea55e Bug 30319
ff0612c2e7df1b86fc702c72e3015a6a5ae39b4c and
2dbd0fd11799c18bb6c66e337c3e31a1419823d4 Fix OOB access possibility
3bebe289aace6daa84b3d6983cebf5c58ddfad78 Fix problem with Indic shaper and control chars
90138e5a4d15c44f05456f90083ecacdc3196c8e Fix bad memory access in Myanmar shaper
b847f24ce855d24f6822bcd9c0006905e81b94d8 Fix Arabic cursive positioning
3ab7b37bdebf0f8773493a1fee910b151c4de30f Fix misc leaks

Change-Id: I6f3a6253782bff6abe4bf741d11c09fdd67542db
(cherry picked from qtbase/7df995a9bd3e989b4136f98424490604eb5178aa)
Reviewed-by: Konstantin Ritt <ritt.ks@gmail.com>

7 files changed, 23 insertions, 14 deletions

diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c b/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c
index 3837087..51f839a 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-arabic.c
@@ -1111,16 +1111,22 @@ HB_Bool HB_ArabicShape(HB_ShaperItem *item)
 
     if (HB_SelectScript(item, item->item.script == HB_Script_Arabic ? arabic_features : syriac_features)) {
         HB_Bool ot_ok;
-        if (arabicSyriacOpenTypeShape(item, &ot_ok))
+        if (arabicSyriacOpenTypeShape(item, &ot_ok)) {
+            HB_FREE_STACKARRAY(shapedChars);
             return TRUE;
-        if (ot_ok)
+        }
+        if (ot_ok) {
+            HB_FREE_STACKARRAY(shapedChars);
             return FALSE;
             /* fall through to the non OT code*/
+        }
     }
 #endif
 
-    if (item->item.script != HB_Script_Arabic)
+    if (item->item.script != HB_Script_Arabic) {
+        HB_FREE_STACKARRAY(shapedChars);
         return HB_BasicShape(item);
+    }
 
     shapedString(item->string, item->stringLength, item->item.pos, item->item.length, shapedChars, &slen,
                   item->item.bidiLevel % 2,
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
index 78f4c3a..36b9a0a 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
@@ -5174,13 +5174,13 @@ static HB_Error  Lookup_ChainContextPos2(
   if ( error )
     return error;
 
+  if (ccpf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccpf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccpf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c
index 21fec51..ceb7034 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.c
@@ -3158,13 +3158,13 @@ static HB_Error  Lookup_ChainContextSubst2( HB_GSUBHeader*               gsub,
   if ( error )
     return error;
 
+  if (ccsf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccsf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccsf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccsf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
index bbf479e..d8093ae 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
@@ -37,7 +37,7 @@ static HB_Bool isLetter(HB_UChar16 ucs)
                      FLAG(HB_Letter_Titlecase) |
                      FLAG(HB_Letter_Modifier) |
                      FLAG(HB_Letter_Other);
-    return (FLAG(HB_GetUnicodeCharCategory(ucs)) &  test) != 0;
+    return !!(FLAG(HB_GetUnicodeCharCategory(ucs)) & test);
 }
 
 static HB_Bool isMark(HB_UChar16 ucs)
@@ -45,7 +45,7 @@ static HB_Bool isMark(HB_UChar16 ucs)
     const int test = FLAG(HB_Mark_NonSpacing) |
                      FLAG(HB_Mark_SpacingCombining) |
                      FLAG(HB_Mark_Enclosing);
-    return FLAG(HB_GetUnicodeCharCategory(ucs)) & test;
+    return !!(FLAG(HB_GetUnicodeCharCategory(ucs)) & test);
 }
 
 enum Form {
@@ -1683,6 +1683,7 @@ static bool indic_shape_syllable(HB_Bool openType, HB_ShaperItem *item, bool inv
                 }
                 item->glyphs[j] = item->glyphs[i];
                 item->attributes[j] = item->attributes[i];
+                item->offsets[j] = item->offsets[i];
                 item->advances[j] = item->advances[i];
                 ++i;
                 ++j;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c b/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c
index 4b68e64..1da5bbf 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c
@@ -359,7 +359,8 @@ static HB_Bool myanmar_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
         if (kinzi >= 0 && i > base && (cc & Mymr_CF_AFTER_KINZI)) {
             reordered[len] = Mymr_C_NGA;
             reordered[len+1] = Mymr_C_VIRAMA;
-            properties[len-1] = AboveForm;
+            if (len > 0)
+                properties[len-1] = AboveForm;
             properties[len] = AboveForm;
             len += 2;
             kinzi = -1;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
index 3811ba9..76c5177 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
@@ -1354,7 +1354,7 @@ HB_Bool HB_OpenTypePosition(HB_ShaperItem *item, int availableGlyphs, HB_Bool do
                 adjustment = HB_FIXED_ROUND(adjustment);
 
             if (positions[i].new_advance) {
-                advances[i] = adjustment;
+                ; //advances[i] = adjustment;
             } else {
                 advances[i] += adjustment;
             }
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c b/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c
index bfa31b1..be38ab2 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c
@@ -90,7 +90,7 @@ static const unsigned char tibetanForm[0x80] = {
 
 
 #define tibetan_form(c) \
-    (TibetanForm)tibetanForm[c - 0x0f40]
+    ((c) >= 0x0f40 && (c) < 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
 
 static const HB_OpenTypeFeature tibetan_features[] = {
     { HB_MAKE_TAG('c', 'c', 'm', 'p'), CcmpProperty },
@@ -113,6 +113,7 @@ static HB_Bool tibetan_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
 
     if (item->num_glyphs < item->item.length + 4) {
         item->num_glyphs = item->item.length + 4;
+        HB_FREE_STACKARRAY(reordered);
         return FALSE;
     }