From 8741914a8043757d4800b14192980fbc1ea24492 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Mon, 29 Mar 2021 16:39:44 -0700
Subject: [PATCH] [subset] fix memory leak when map insert fails.

---
 src/hb-ot-layout-common.hh                     |  17 ++++++++++++-----
 ...minimized-hb-subset-fuzzer-6421315436281856 | Bin 0 -> 59 bytes
 2 files changed, 12 insertions(+), 5 deletions(-)
 create mode 100644 test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6421315436281856

diff --git a/src/hb-ot-layout-common.hh b/src/hb-ot-layout-common.hh
index 5b758a875..384127c52 100644
--- a/src/hb-ot-layout-common.hh
+++ b/src/hb-ot-layout-common.hh
@@ -485,7 +485,7 @@ struct RecordListOfScript : RecordListOf<Script>
       if (!ret) c->serializer->revert (snap);
       else out->len++;
     }
-    
+
     return_trace (true);
   }
 };
@@ -699,8 +699,15 @@ struct Script
     if (c->visitedScript (this)) return;
 
     if (!c->script_langsys_map->has (script_index))
-      c->script_langsys_map->set (script_index, hb_set_create ());
-    
+    {
+      hb_set_t* empty_set = hb_set_create ();
+      c->script_langsys_map->set (script_index, empty_set);
+      if (!c->script_langsys_map->has (script_index)) {
+        hb_set_destroy (empty_set);
+        return;
+      }
+    }
+
     unsigned langsys_count = get_lang_sys_count ();
     if (has_default_lang_sys ())
     {
@@ -2244,7 +2251,7 @@ struct ClassDefFormat2
     for (unsigned int i = 0; i < count; i++)
     {
       if (rangeRecord[i].value != klass) continue;
-      
+
       if (g != HB_SET_VALUE_INVALID)
       {
         if (g >= rangeRecord[i].first &&
@@ -2253,7 +2260,7 @@ struct ClassDefFormat2
         if (g > rangeRecord[i].last)
           continue;
       }
-      
+
       g = rangeRecord[i].first - 1;
       while (hb_set_next (glyphs, &g))
       {
diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6421315436281856 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6421315436281856
new file mode 100644
index 0000000000000000000000000000000000000000..3d883bd577be17de01490c158059b33b316b839d
GIT binary patch
literal 59
ucmZQzWME)mQUC+@0RLbR11KWF021e7-~^J4U@;B`76t|dh5rg55)1&BI0bb8

literal 0
HcmV?d00001