fixed memory leaks

in CFF1 & CFF2 accelerators, VORG subsetter

src/hb-ot-cff1-table.hh

@@ -1093,6 +1093,8 @@ struct cff1
       sc.end_processing ();
       topDict.fini ();
       fontDicts.fini ();
+      for (unsigned int i = 0; i < privateDicts.len; i++)
+        privateDicts[i].fini ();
       privateDicts.fini ();
       hb_blob_destroy (blob);
       blob = nullptr;

src/hb-ot-cff2-table.hh

@@ -491,6 +491,8 @@ struct cff2
     {
       sc.end_processing ();
       fontDicts.fini ();
+      for (unsigned int i = 0; i < privateDicts.len; i++)
+        privateDicts[i].fini ();
       privateDicts.fini ();
       hb_blob_destroy (blob);
       blob = nullptr;

src/hb-ot-vorg-table.hh

@@ -129,6 +129,7 @@ struct VORG
     if (unlikely (!dest))
     {
       subset_metrics.fini ();
+      hb_blob_destroy (vorg_blob);
       return false;
     }
 
@@ -137,6 +138,7 @@ struct VORG
     {
       subset_metrics.fini ();
       free (dest);
+      hb_blob_destroy (vorg_blob);
       return false;
     }
 
@@ -148,6 +150,7 @@ struct VORG
     bool success = plan->add_table (HB_OT_TAG_VORG, result);
     hb_blob_destroy (result);
     subset_metrics.fini ();
+    hb_blob_destroy (vorg_blob);
     return success;
   }