1 files changed, 24 insertions, 7 deletions

diff --git a/third_party/harfbuzz/src/harfbuzz-open.c b/third_party/harfbuzz/src/harfbuzz-open.c
index 0fe1e4d..f12f5b7 100644
--- a/third_party/harfbuzz/src/harfbuzz-open.c
+++ b/third_party/harfbuzz/src/harfbuzz-open.c
@@ -1282,9 +1282,10 @@ _HB_OPEN_Get_Class( HB_ClassDefinition* cd,
 
 
 HB_INTERNAL HB_Error
-_HB_OPEN_Load_Device( HB_Device* d,
+_HB_OPEN_Load_Device( HB_Device** device,
 		       HB_Stream    stream )
 {
+  HB_Device*  d;
   HB_Error   error;
 
   HB_UShort   n, count;
@@ -1295,6 +1296,14 @@ _HB_OPEN_Load_Device( HB_Device* d,
   if ( ACCESS_Frame( 6L ) )
     return error;
 
+  if ( ALLOC( *device, sizeof(HB_Device)) )
+  {
+    *device = 0;
+    return error;
+  }
+
+  d = *device;
+
   d->StartSize   = GET_UShort();
   d->EndSize     = GET_UShort();
   d->DeltaFormat = GET_UShort();
@@ -1318,11 +1327,17 @@ _HB_OPEN_Load_Device( HB_Device* d,
 	      ( 4 - d->DeltaFormat ) ) + 1;
 
   if ( ALLOC_ARRAY( d->DeltaValue, count, HB_UShort ) )
+  {
+    FREE( *device );
+    *device = 0;
     return error;
+  }
 
   if ( ACCESS_Frame( count * 2L ) )
   {
     FREE( d->DeltaValue );
+    FREE( *device );
+    *device = 0;
     return error;
   }
 
@@ -1340,7 +1355,11 @@ _HB_OPEN_Load_Device( HB_Device* d,
 HB_INTERNAL void
 _HB_OPEN_Free_Device( HB_Device* d )
 {
-  FREE( d->DeltaValue );
+  if ( d )
+  {
+    FREE( d->DeltaValue );
+    FREE( d );
+  }
 }
 
 
@@ -1384,13 +1403,11 @@ _HB_OPEN_Get_Device( HB_Device* d,
 		      HB_UShort    size,
 		      HB_Short*    value )
 {
-  HB_UShort  byte, bits, mask, f, s;
-
-
-  f = d->DeltaFormat;
+  HB_UShort  byte, bits, mask, s;
 
-  if ( d->DeltaValue && size >= d->StartSize && size <= d->EndSize )
+  if ( d && d->DeltaValue && size >= d->StartSize && size <= d->EndSize )
   {
+    HB_UShort f = d->DeltaFormat;
     s    = size - d->StartSize;
     byte = d->DeltaValue[s >> ( 4 - f )];
     bits = byte >> ( 16 - ( ( s % ( 1 << ( 4 - f ) ) + 1 ) << f ) );