[Harfbuzz] Fix OOB read in tibetan_form()

third_party/harfbuzz/chromium.patch

 diff --git a/contrib/harfbuzz-unicode.c b/contrib/harfbuzz-unicode.c
-index ce4f8e2..eeff2b9 100644
+index 72c5cf2..49e47b0 100644
 --- a/contrib/harfbuzz-unicode.c
 +++ b/contrib/harfbuzz-unicode.c
 @@ -120,7 +120,6 @@ hb_utf16_script_run_next(unsigned *num_code_points, HB_ScriptItem *output,
          current_script = script;
          continue;
        } else if (script == HB_Script_Inherited) {
 -        current_script = script;
          continue;
        } else {
          *iter = prev_iter;
@@ skipping 14 matching lines @@
 --- a/src/harfbuzz-arabic.c
 +++ b/src/harfbuzz-arabic.c
 @@ -1107,6 +1107,7 @@ HB_Bool HB_ArabicShape(HB_ShaperItem *item)
      assert(item->item.script == HB_Script_Arabic || item->item.script == HB_Script_Syriac
             || item->item.script == HB_Script_Nko);
  
 +    item->shaperFlags |= HB_ShaperFlag_ForceMarksToZeroWidth;
  #ifndef NO_OPENTYPE
  
      if (HB_SelectScript(item, item->item.script == HB_Script_Arabic ? arabic_features : syriac_features)) {
-diff --git a/src/harfbuzz-myanmar.c b/src/harfbuzz-myanmar.c
-index 4b68e64..f4d6d78 100644
---- a/src/harfbuzz-myanmar.c
-+++ b/src/harfbuzz-myanmar.c
-@@ -359,7 +359,8 @@ static HB_Bool myanmar_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_
-         if (kinzi >= 0 && i > base && (cc & Mymr_CF_AFTER_KINZI)) {
-             reordered[len] = Mymr_C_NGA;
-             reordered[len+1] = Mymr_C_VIRAMA;
--            properties[len-1] = AboveForm;
-+            if (len > 0)
-+                properties[len-1] = AboveForm;
-             properties[len] = AboveForm;
-             len += 2;
-             kinzi = -1;
 diff --git a/src/harfbuzz-shaper.cpp b/src/harfbuzz-shaper.cpp
-index ce4d4ac..5999e08 100644
+index 7d433ea..dd86a40 100644
 --- a/src/harfbuzz-shaper.cpp
 +++ b/src/harfbuzz-shaper.cpp
 @@ -430,8 +430,6 @@ void HB_HeuristicSetGlyphAttributes(HB_ShaperItem *item)
  
      // ### zeroWidth and justification are missing here!!!!!
  
 -    assert(item->num_glyphs <= length);
 -
  //     qDebug("QScriptEngine::heuristicSetGlyphAttributes, num_glyphs=%d", item->num_glyphs);
      HB_GlyphAttributes *attributes = item->attributes;
@@ skipping 64 matching lines @@
      HB_ShaperFlag_NoKerning = 1,
 -    HB_ShaperFlag_UseDesignMetrics = 2
 +    HB_ShaperFlag_UseDesignMetrics = 1 << 1,
 +    /* Arabic vowels in some fonts (Times New Roman, at least) have
 +       non-zero advances, when they should be zero.  Setting this shaper
 +       flag causes us to zero out the advances for mark glyphs. */
 +    HB_ShaperFlag_ForceMarksToZeroWidth = 1 << 2
  } HB_ShaperFlag;
  
  /* 
+diff --git a/src/harfbuzz-tibetan.c b/src/harfbuzz-tibetan.c
+index 847ac52..6f9a55b 100644
+--- a/src/harfbuzz-tibetan.c
++++ b/src/harfbuzz-tibetan.c
+@@ -90,7 +90,7 @@ static const unsigned char tibetanForm[0x80] = {
+ 
+ 
+ #define tibetan_form(c) \
+-    ((c) >= 0x0f40 && (c) <= 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
++    ((c) >= 0x0f40 && (c) < 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
+ 
+ static const HB_OpenTypeFeature tibetan_features[] = {
+     { HB_MAKE_TAG('c', 'c', 'm', 'p'), CcmpProperty },