From dae32b4f12da5d90de32886b0fd16653e3853e25 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Tue, 28 Jul 2020 18:31:46 -0700
Subject: [PATCH] [subset] bail out of subsetting if plan allocation fails.

---
 src/hb-face.cc        | 3 +++
 src/hb-subset-plan.cc | 6 +++++-
 src/hb-subset-plan.hh | 6 ++++++
 src/hb-subset.cc      | 3 +++
 4 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/hb-face.cc b/src/hb-face.cc
index 95d3fc27f..7bde50df5 100644
--- a/src/hb-face.cc
+++ b/src/hb-face.cc
@@ -721,7 +721,10 @@ hb_face_builder_add_table (hb_face_t *face, hb_tag_t tag, hb_blob_t *blob)
     return false;
 
   hb_face_builder_data_t *data = (hb_face_builder_data_t *) face->user_data;
+
   hb_face_builder_data_t::table_entry_t *entry = data->tables.push ();
+  if (data->tables.in_error())
+    return false;
 
   entry->tag = tag;
   entry->blob = hb_blob_reference (blob);
diff --git a/src/hb-subset-plan.cc b/src/hb-subset-plan.cc
index b16f5077c..46b83e375 100644
--- a/src/hb-subset-plan.cc
+++ b/src/hb-subset-plan.cc
@@ -314,8 +314,12 @@ hb_subset_plan_t *
 hb_subset_plan_create (hb_face_t         *face,
 		       hb_subset_input_t *input)
 {
-  hb_subset_plan_t *plan = hb_object_create<hb_subset_plan_t> ();
+  hb_subset_plan_t *plan;
+  if (unlikely (!(plan = hb_object_create<hb_subset_plan_t> ()))) {
+    return const_cast<hb_subset_plan_t *> (&Null (hb_subset_plan_t));
+  }
 
+  plan->successful = true;
   plan->drop_hints = input->drop_hints;
   plan->desubroutinize = input->desubroutinize;
   plan->retain_gids = input->retain_gids;
diff --git a/src/hb-subset-plan.hh b/src/hb-subset-plan.hh
index 7a85b5137..08b8f74d7 100644
--- a/src/hb-subset-plan.hh
+++ b/src/hb-subset-plan.hh
@@ -39,6 +39,7 @@ struct hb_subset_plan_t
 {
   hb_object_header_t header;
 
+  bool successful : 1;
   bool drop_hints : 1;
   bool desubroutinize : 1;
   bool retain_gids : 1;
@@ -89,6 +90,11 @@ struct hb_subset_plan_t
 
  public:
 
+  bool in_error () const
+  {
+    return !successful;
+  }
+
   /*
    * The set of input glyph ids which will be retained in the subset.
    * Does NOT include ids kept due to retain_gids. You probably want to use
diff --git a/src/hb-subset.cc b/src/hb-subset.cc
index 31127392b..8b77ecd45 100644
--- a/src/hb-subset.cc
+++ b/src/hb-subset.cc
@@ -241,6 +241,8 @@ hb_subset (hb_face_t *source, hb_subset_input_t *input)
   if (unlikely (!input || !source)) return hb_face_get_empty ();
 
   hb_subset_plan_t *plan = hb_subset_plan_create (source, input);
+  if (unlikely (plan->in_error ()))
+    return hb_face_get_empty ();
 
   hb_set_t tags_set;
   bool success = true;
@@ -261,6 +263,7 @@ hb_subset (hb_face_t *source, hb_subset_input_t *input)
 end:
 
   hb_face_t *result = success ? hb_face_reference (plan->dest) : hb_face_get_empty ();
+
   hb_subset_plan_destroy (plan);
   return result;
 }