Harfbuzz: backporting fixes from upstream

81c8ef785b079980ad5b46be4fe7c7bf156dbf65 Fix crash!
81f2ecafa19b602f950df5a9e6e1b99c4b5ea55e Bug 30319
ff0612c2e7df1b86fc702c72e3015a6a5ae39b4c and
2dbd0fd11799c18bb6c66e337c3e31a1419823d4 Fix OOB access possibility
3bebe289aace6daa84b3d6983cebf5c58ddfad78 Fix problem with Indic shaper and control chars
90138e5a4d15c44f05456f90083ecacdc3196c8e Fix bad memory access in Myanmar shaper
b847f24ce855d24f6822bcd9c0006905e81b94d8 Fix Arabic cursive positioning
3ab7b37bdebf0f8773493a1fee910b151c4de30f Fix misc leaks

Change-Id: I6f3a6253782bff6abe4bf741d11c09fdd67542db
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

src/3rdparty/harfbuzz/src/harfbuzz-arabic.c

@@ -1114,16 +1114,22 @@ HB_Bool HB_ArabicShape(HB_ShaperItem *item)
 
     if (HB_SelectScript(item, item->item.script == HB_Script_Arabic ? arabic_features : syriac_features)) {
         HB_Bool ot_ok;
-        if (arabicSyriacOpenTypeShape(item, &ot_ok))
+        if (arabicSyriacOpenTypeShape(item, &ot_ok)) {
+            HB_FREE_STACKARRAY(shapedChars);
             return TRUE;
-        if (ot_ok)
+        }
+        if (ot_ok) {
+            HB_FREE_STACKARRAY(shapedChars);
             return FALSE;
             /* fall through to the non OT code*/
         }
+    }
 #endif
 
-    if (item->item.script != HB_Script_Arabic)
+    if (item->item.script != HB_Script_Arabic) {
+        HB_FREE_STACKARRAY(shapedChars);
         return HB_BasicShape(item);
+    }
 
     shapedString(item->string, item->stringLength, item->item.pos, item->item.length, shapedChars, &slen,
                   item->item.bidiLevel % 2,

src/3rdparty/harfbuzz/src/harfbuzz-gpos.c

@@ -3193,6 +3193,9 @@ static HB_Error  Lookup_MarkMarkPos( GPOS_Instance*    gpi,
     j--;
   }
 
+  if ( i > buffer->in_pos )
+    return HB_Err_Not_Covered;
+
   error = _HB_OPEN_Coverage_Index( &mmp->Mark2Coverage, IN_GLYPH( j ),
 			  &mark2_index );
   if ( error )
@@ -5349,13 +5352,13 @@ static HB_Error  Lookup_ChainContextPos2(
   if ( error )
     return error;
 
+  if (ccpf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccpf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccpf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccpf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;

src/3rdparty/harfbuzz/src/harfbuzz-gsub.c

@@ -3158,13 +3158,13 @@ static HB_Error  Lookup_ChainContextSubst2( HB_GSUBHeader*               gsub,
   if ( error )
     return error;
 
+  if (ccsf2->MaxInputLength < 1)
+    return HB_Err_Not_Covered;
+
   if ( ALLOC_ARRAY( backtrack_classes, ccsf2->MaxBacktrackLength, HB_UShort ) )
     return error;
   known_backtrack_classes = 0;
 
-  if (ccsf2->MaxInputLength < 1)
-    return HB_Err_Not_Covered;
-
   if ( ALLOC_ARRAY( input_classes, ccsf2->MaxInputLength, HB_UShort ) )
     goto End3;
   known_input_classes = 1;

src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp

@@ -37,7 +37,7 @@ static HB_Bool isLetter(HB_UChar16 ucs)
                      FLAG(HB_Letter_Titlecase) |
                      FLAG(HB_Letter_Modifier) |
                      FLAG(HB_Letter_Other);
-    return (FLAG(HB_GetUnicodeCharCategory(ucs)) &  test) != 0;
+    return !!(FLAG(HB_GetUnicodeCharCategory(ucs)) & test);
 }
 
 static HB_Bool isMark(HB_UChar16 ucs)
@@ -45,7 +45,7 @@ static HB_Bool isMark(HB_UChar16 ucs)
     const int test = FLAG(HB_Mark_NonSpacing) |
                      FLAG(HB_Mark_SpacingCombining) |
                      FLAG(HB_Mark_Enclosing);
-    return FLAG(HB_GetUnicodeCharCategory(ucs)) & test;
+    return !!(FLAG(HB_GetUnicodeCharCategory(ucs)) & test);
 }
 
 enum Form {
@@ -1683,6 +1683,7 @@ static bool indic_shape_syllable(HB_Bool openType, HB_ShaperItem *item, bool inv
                 }
                 item->glyphs[j] = item->glyphs[i];
                 item->attributes[j] = item->attributes[i];
+                item->offsets[j] = item->offsets[i];
                 item->advances[j] = item->advances[i];
                 ++i;
                 ++j;

src/3rdparty/harfbuzz/src/harfbuzz-myanmar.c

@@ -359,6 +359,7 @@ static HB_Bool myanmar_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
         if (kinzi >= 0 && i > base && (cc & Mymr_CF_AFTER_KINZI)) {
             reordered[len] = Mymr_C_NGA;
             reordered[len+1] = Mymr_C_VIRAMA;
+            if (len > 0)
                 properties[len-1] = AboveForm;
             properties[len] = AboveForm;
             len += 2;

src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp

@@ -1033,7 +1033,7 @@ HB_Bool HB_OpenTypePosition(HB_ShaperItem *item, int availableGlyphs, HB_Bool do
                 adjustment = HB_FIXED_ROUND(adjustment);
 
             if (positions[i].new_advance) {
-                advances[i] = adjustment;
+                ; //advances[i] = adjustment;
             } else {
                 advances[i] += adjustment;
             }

src/3rdparty/harfbuzz/src/harfbuzz-tibetan.c

@@ -90,7 +90,7 @@ static const unsigned char tibetanForm[0x80] = {
 
 
 #define tibetan_form(c) \
-    (TibetanForm)tibetanForm[c - 0x0f40]
+    ((c) >= 0x0f40 && (c) < 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
 
 #ifndef NO_OPENTYPE
 static const HB_OpenTypeFeature tibetan_features[] = {
@@ -115,6 +115,7 @@ static HB_Bool tibetan_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
 
     if (item->num_glyphs < item->item.length + 4) {
         item->num_glyphs = item->item.length + 4;
+        HB_FREE_STACKARRAY(reordered);
         return FALSE;
     }