OOB read in harfbuzz with khmer character.

third_party/harfbuzz/chromium.patch

 diff --git a/contrib/harfbuzz-unicode.c b/contrib/harfbuzz-unicode.c
 index 51dd4ea..cb7a85b 100644
 --- a/contrib/harfbuzz-unicode.c
 +++ b/contrib/harfbuzz-unicode.c
 @@ -171,7 +171,10 @@ hb_utf16_script_run_prev(unsigned *num_code_points, HB_ScriptItem *output,
          current_script = script;
          continue;
        } else if (script == HB_Script_Inherited) {
 -        current_script = script;
 +        // Just assume that whatever follows this combining character is within
 +        // the same script.  This is incorrect if you had language1 + combining
 +        // char + language 2, but that is rare and this code is suspicious
 +        // anyway.
          continue;
        } else {
          *iter = prev_iter;
+diff --git a/src/harfbuzz-gpos.c b/src/harfbuzz-gpos.c
+index 356dc01..db5ea0a 100644
+--- a/src/harfbuzz-gpos.c
++++ b/src/harfbuzz-gpos.c
+@@ -2976,6 +2976,9 @@ static HB_Error  Lookup_MarkMarkPos( GPOS_Instance*    gpi,
+     j--;
+   }
+ 
++  if ( i > buffer->in_pos )
++    return HB_Err_Not_Covered;
++
+   error = _HB_OPEN_Coverage_Index( &mmp->Mark2Coverage, IN_GLYPH( j ),
+                          &mark2_index );
+   if ( error )
 diff --git a/src/harfbuzz-shaper.cpp b/src/harfbuzz-shaper.cpp
-index f3ec8e1..2b0dfde 100644
+index f3ec8e1..2b52221 100644
 --- a/src/harfbuzz-shaper.cpp
 +++ b/src/harfbuzz-shaper.cpp
 @@ -433,7 +433,7 @@ void HB_HeuristicSetGlyphAttributes(HB_ShaperItem *item)
  
      // ### zeroWidth and justification are missing here!!!!!
  
 -    assert(item->num_glyphs <= length);
 +    assert(length <= item->num_glyphs);
  
  //     qDebug("QScriptEngine::heuristicSetGlyphAttributes, num_glyphs=%d", item->num_glyphs);
      HB_GlyphAttributes *attributes = item->attributes;
 @@ -451,7 +451,6 @@ void HB_HeuristicSetGlyphAttributes(HB_ShaperItem *item)
          }
          ++glyph_pos;
      }
 -    assert(glyph_pos == item->num_glyphs);
  
      // first char in a run is never (treated as) a mark
      int cStart = 0;
-diff --git a/src/harfbuzz-gpos.c b/src/harfbuzz-gpos.c
-index 356dc01..db5ea0a 100644
---- a/src/harfbuzz-gpos.c
-+++ b/src/harfbuzz-gpos.c
-@@ -2976,6 +2976,9 @@ static HB_Error  Lookup_MarkMarkPos( GPOS_Instance*    gpi,
-     j--;
-   }
+@@ -1151,10 +1150,11 @@ HB_Bool HB_OpenTypeShape(HB_ShaperItem *item, const hb_uint32 *properties)
+         return false;
+     face->tmpLogClusters = tmpLogClusters;
  
-+  if ( i > buffer->in_pos )
-+    return HB_Err_Not_Covered;
-+
-   error = _HB_OPEN_Coverage_Index( &mmp->Mark2Coverage, IN_GLYPH( j ),
-                          &mark2_index );
-   if ( error )
++    const int itemLength = item->item.length;
+     for (int i = 0; i < face->length; ++i) {
+         hb_buffer_add_glyph(face->buffer, item->glyphs[i], properties ? properties[i] : 0, i);
+         face->tmpAttributes[i] = item->attributes[i];
+-        face->tmpLogClusters[i] = item->log_clusters[i];
++        face->tmpLogClusters[i] = i < itemLength ? item->log_clusters[i] : item->log_clusters[itemLength - 1];
+     }
+ 
+ #ifdef OT_DEBUG