From f2d227ad9f03038ddbdb70b5a45adb29a19f5fb0 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Sat, 25 Feb 2023 09:30:40 -0700
Subject: [PATCH] [wasm-api] Respect existing blob allocation in face_copy_blob

---
 src/hb-wasm-api-face.hh             | 19 +++++++++++++++++--
 src/hb-wasm-api.h                   |  1 +
 src/wasm/graphite/shape.cc          |  2 +-
 src/wasm/sample/c/shape-fallback.cc |  2 +-
 4 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/src/hb-wasm-api-face.hh b/src/hb-wasm-api-face.hh
index ce767c030..ece557f46 100644
--- a/src/hb-wasm-api-face.hh
+++ b/src/hb-wasm-api-face.hh
@@ -44,10 +44,25 @@ HB_WASM_API (bool_t, face_copy_table) (HB_WASM_EXEC_ENV
   hb_blob_t *hb_blob = hb_face_reference_table (face, table_tag);
 
   unsigned length;
-  const char *data = hb_blob_get_data (hb_blob, &length);
+  const char *hb_data = hb_blob_get_data (hb_blob, &length);
+
+  if (length <= blob->length)
+  {
+    char *data = (char *) (validate_app_addr (blob->data, blob->length) ? addr_app_to_native (blob->data) : nullptr);
+
+    if (unlikely (!data))
+    {
+      blob->length = 0;
+      return false;
+    }
+
+    memcpy (data, hb_data, length);
+
+    return true;
+  }
 
   blob->length = length;
-  blob->data = wasm_runtime_module_dup_data (module_inst, data, length);
+  blob->data = wasm_runtime_module_dup_data (module_inst, hb_data, length);
 
   hb_blob_destroy (hb_blob);
 
diff --git a/src/hb-wasm-api.h b/src/hb-wasm-api.h
index 6c9714c44..0b09f4de9 100644
--- a/src/hb-wasm-api.h
+++ b/src/hb-wasm-api.h
@@ -108,6 +108,7 @@ typedef struct
   uint32_t length;
   ptr_t(char) data;
 } blob_t;
+#define BLOB_INIT {0, 0}
 
 HB_WASM_API (void, blob_free) (HB_WASM_EXEC_ENV
 			       ptr_d(blob_t, blob));
diff --git a/src/wasm/graphite/shape.cc b/src/wasm/graphite/shape.cc
index 70d966d62..6214a1525 100644
--- a/src/wasm/graphite/shape.cc
+++ b/src/wasm/graphite/shape.cc
@@ -21,7 +21,7 @@ uint32_t heap_size = 2 * 1024 * 1024;
 static const void *copy_table (const void *data, unsigned int tag, size_t *len)
 {
   face_t *face = (face_t *) data;
-  blob_t blob;
+  blob_t blob = BLOB_INIT;
   if (!face_copy_table (face, tag, &blob))
     abort ();
 
diff --git a/src/wasm/sample/c/shape-fallback.cc b/src/wasm/sample/c/shape-fallback.cc
index 5bf220928..004be0ef0 100644
--- a/src/wasm/sample/c/shape-fallback.cc
+++ b/src/wasm/sample/c/shape-fallback.cc
@@ -18,7 +18,7 @@ shape (void *shape_plan,
 {
   face_t *face = font_get_face (font);
 
-  blob_t blob;
+  blob_t blob = BLOB_INIT;
   if (!face_copy_table (face, TAG ('c','m','a','p'), &blob))
     abort ();