From 5a36b55fba03cd07c9b101f0222b8d189bcd3bbf Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 23 Feb 2018 15:30:14 -0800
Subject: [PATCH 1/6] [subset] Fix memory leak in subset face destroy.

---
 src/hb-subset.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/hb-subset.cc b/src/hb-subset.cc
index b7d3e3710..aff3aecc6 100644
--- a/src/hb-subset.cc
+++ b/src/hb-subset.cc
@@ -136,6 +136,9 @@ _hb_subset_face_data_destroy (void *user_data)
 {
   hb_subset_face_data_t *data = (hb_subset_face_data_t *) user_data;
 
+  for (int i = 0; i < data->tables.len; i++)
+    hb_blob_destroy (data->tables[i].blob);
+
   data->tables.finish ();
 
   free (data);

From 4665aaa19304bdf0362bdfcebcae65feb19a8964 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 23 Feb 2018 15:36:14 -0800
Subject: [PATCH 2/6] [subset] Fix memory leak in hmtx subsetting.

---
 src/hb-ot-hmtx-table.hh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/hb-ot-hmtx-table.hh b/src/hb-ot-hmtx-table.hh
index 11cc92794..3cd48a62e 100644
--- a/src/hb-ot-hmtx-table.hh
+++ b/src/hb-ot-hmtx-table.hh
@@ -105,7 +105,7 @@ struct hmtxvmtx
     /* alloc the new table */
     size_t dest_sz = num_advances * 4
                   + (gids.len - num_advances) * 2;
-    void *dest = (void *) calloc (dest_sz, 1);
+    void *dest = (void *) malloc (dest_sz);
     if (unlikely (!dest))
     {
       return false;
@@ -166,9 +166,11 @@ struct hmtxvmtx
     hb_blob_t *result = hb_blob_create ((const char *)dest,
                                         dest_sz,
                                         HB_MEMORY_MODE_READONLY,
-                                        /* userdata */ nullptr,
+                                        dest,
                                         free);
-    return hb_subset_plan_add_table (plan, T::tableTag, result);
+    bool success = hb_subset_plan_add_table (plan, T::tableTag, result);
+    hb_blob_destroy (result);
+    return success;
   }
 
   struct accelerator_t

From 0fb8a5ce192025ffd83ae714db932e4b86594ae1 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 23 Feb 2018 15:37:43 -0800
Subject: [PATCH 3/6] [subset] Fix memory leak in cmap subsetting.

---
 src/hb-ot-cmap-table.hh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
index 4593152b5..020798986 100644
--- a/src/hb-ot-cmap-table.hh
+++ b/src/hb-ot-cmap-table.hh
@@ -602,7 +602,7 @@ struct cmap
                    + 8 // 1 EncodingRecord
                    + 16 // Format 12 header
                    + 12 * groups.len; // SequentialMapGroup records
-    void *dest = calloc (dest_sz, 1);
+    void *dest = malloc (dest_sz);
     if (unlikely (!dest)) {
       DEBUG_MSG(SUBSET, nullptr, "Unable to alloc %lu for cmap subset output", (unsigned long) dest_sz);
       return false;
@@ -618,9 +618,11 @@ struct cmap
     hb_blob_t *cmap_prime = hb_blob_create ((const char *)dest,
                                             dest_sz,
                                             HB_MEMORY_MODE_READONLY,
-                                            /* userdata */ nullptr,
+                                            dest,
                                             free);
-    return hb_subset_plan_add_table (plan, HB_OT_TAG_cmap, cmap_prime);
+    bool result =  hb_subset_plan_add_table (plan, HB_OT_TAG_cmap, cmap_prime);
+    hb_blob_destroy (cmap_prime);
+    return result;
   }
 
   struct accelerator_t

From 66b0a390793ab06692dd49e67baef52a6a7d82aa Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 23 Feb 2018 15:41:52 -0800
Subject: [PATCH 4/6] [subset] Fix memory leak in hb-subset.

---
 src/hb-subset.cc | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/hb-subset.cc b/src/hb-subset.cc
index aff3aecc6..3a0ddb036 100644
--- a/src/hb-subset.cc
+++ b/src/hb-subset.cc
@@ -263,14 +263,11 @@ _subset_table (hb_subset_plan_t *plan,
       break;
     default:
       hb_blob_t *source_table = hb_face_reference_table(plan->source, tag);
-      if (likely(source_table))
-      {
+      if (likely (source_table))
         result = hb_subset_plan_add_table(plan, tag, source_table);
-      }
       else
-      {
         result = false;
-      }
+      hb_blob_destroy (source_table);
       break;
   }
   DEBUG_MSG(SUBSET, nullptr, "subset %c%c%c%c %s", HB_UNTAG(tag), result ? "ok" : "FAILED");

From e61f360dc828bfd46477b7ddff56874da9f03538 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 23 Feb 2018 15:44:21 -0800
Subject: [PATCH 5/6] [subset] Fix memory leak in hb-subset-plan.

---
 src/hb-subset-plan.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/hb-subset-plan.cc b/src/hb-subset-plan.cc
index b9e299add..27c2c7f02 100644
--- a/src/hb-subset-plan.cc
+++ b/src/hb-subset-plan.cc
@@ -165,6 +165,7 @@ _populate_gids_to_retain (hb_face_t *face,
   while (hb_set_next (all_gids_to_retain, &gid))
     *(old_gids_sorted.push ()) = gid;
 
+  hb_set_destroy (all_gids_to_retain);
   glyf.fini ();
   cmap.fini ();
 }

From 99967e21c6e3f6882d6eadf5c22f4120684b1fc5 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 23 Feb 2018 15:45:45 -0800
Subject: [PATCH 6/6] [subset] Fix memory leak in hb-subset-glyf.

---
 src/hb-subset-glyf.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/hb-subset-glyf.cc b/src/hb-subset-glyf.cc
index d57b41159..d29efe9de 100644
--- a/src/hb-subset-glyf.cc
+++ b/src/hb-subset-glyf.cc
@@ -234,6 +234,8 @@ hb_subset_glyf_and_loca (hb_subset_plan_t *plan,
                                           use_short_loca,
                                           glyf_prime,
                                           loca_prime);
+
+  hb_blob_destroy (glyf_blob);
   glyf.fini();
 
   return result;