Update from https://crrev.com/316786

third_party/harfbuzz-ng/src/hb-blob.cc

 /*
  * Copyright © 2009  Red Hat, Inc.
  *
  *  This is part of HarfBuzz, a text shaping library.
  *
  * Permission is hereby granted, without written agreement and without
  * license or royalty fees, to use, copy, modify, and distribute this
  * software and its documentation for any purpose, provided that the
  * above copyright notice and the following two paragraphs appear in
  * all copies of this software.
@@ skipping 60 matching lines @@
 _hb_blob_destroy_user_data (hb_blob_t *blob)
 {
   if (blob->destroy) {
     blob->destroy (blob->user_data);
     blob->user_data = NULL;
     blob->destroy = NULL;
   }
 }
 
 /**
- * hb_blob_create: (Xconstructor)
- * @data: (array length=length) (closure user_data) (destroy destroy) (scope notified) (transfer none): Pointer to blob data.
+ * hb_blob_create: (skip)
+ * @data: Pointer to blob data.
  * @length: Length of @data in bytes.
  * @mode: Memory mode for @data.
  * @user_data: Data parameter to pass to @destroy.
  * @destroy: Callback to call when @data is not needed anymore.
  *
  * Creates a new "blob" object wrapping @data.  The @mode parameter is used
  * to negotiate ownership and lifecycle of @data.
  *
  * Return value: New blob, or the empty blob if something failed or if @length is
  * zero.  Destroy with hb_blob_destroy().
  *
  * Since: 1.0
  **/
 hb_blob_t *
 hb_blob_create (const char        *data,
                 unsigned int       length,
                 hb_memory_mode_t   mode,
                 void              *user_data,
                 hb_destroy_func_t  destroy)
 {
   hb_blob_t *blob;
 
-  if (!length || !(blob = hb_object_create<hb_blob_t> ())) {
+  if (!length ||
+      length >= 1u << 31 ||
+      data + length < data /* overflows */ ||
+      !(blob = hb_object_create<hb_blob_t> ())) {
     if (destroy)
       destroy (user_data);
     return hb_blob_get_empty ();
   }
 
   blob->data = data;
   blob->length = length;
   blob->mode = mode;
 
   blob->user_data = user_data;
@@ skipping 351 matching lines @@
 
   memcpy (new_data, blob->data, blob->length);
   _hb_blob_destroy_user_data (blob);
   blob->mode = HB_MEMORY_MODE_WRITABLE;
   blob->data = new_data;
   blob->user_data = new_data;
   blob->destroy = free;
 
   return true;
 }