From 0fb8a5ce192025ffd83ae714db932e4b86594ae1 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 23 Feb 2018 15:37:43 -0800
Subject: [PATCH] [subset] Fix memory leak in cmap subsetting.

---
 src/hb-ot-cmap-table.hh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
index 4593152b5..020798986 100644
--- a/src/hb-ot-cmap-table.hh
+++ b/src/hb-ot-cmap-table.hh
@@ -602,7 +602,7 @@ struct cmap
                    + 8 // 1 EncodingRecord
                    + 16 // Format 12 header
                    + 12 * groups.len; // SequentialMapGroup records
-    void *dest = calloc (dest_sz, 1);
+    void *dest = malloc (dest_sz);
     if (unlikely (!dest)) {
       DEBUG_MSG(SUBSET, nullptr, "Unable to alloc %lu for cmap subset output", (unsigned long) dest_sz);
       return false;
@@ -618,9 +618,11 @@ struct cmap
     hb_blob_t *cmap_prime = hb_blob_create ((const char *)dest,
                                             dest_sz,
                                             HB_MEMORY_MODE_READONLY,
-                                            /* userdata */ nullptr,
+                                            dest,
                                             free);
-    return hb_subset_plan_add_table (plan, HB_OT_TAG_cmap, cmap_prime);
+    bool result =  hb_subset_plan_add_table (plan, HB_OT_TAG_cmap, cmap_prime);
+    hb_blob_destroy (cmap_prime);
+    return result;
   }
 
   struct accelerator_t