From eaa1f9a64b83aaa87fae52fe3bbda2457bd1c993 Mon Sep 17 00:00:00 2001
From: Vladimir 'phcoder' Serbinenko <phcoder@gmail.com>
Date: Tue, 16 Mar 2010 23:03:08 +0100
Subject: [PATCH] Fix few memory errors

---
 gfxmenu/font.c         |  2 +-
 include/grub/unicode.h | 13 ++++++++-----
 normal/charset.c       |  6 ++++--
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/gfxmenu/font.c b/gfxmenu/font.c
index 0c973620a..a11b31875 100644
--- a/gfxmenu/font.c
+++ b/gfxmenu/font.c
@@ -63,10 +63,10 @@ grub_font_draw_string (const char *str, grub_font_t font,
       if (!glyph)
 	return grub_errno;
       err = grub_font_draw_glyph (glyph, color, x, baseline_y);
+      x += glyph->device_width;
       grub_free (glyph);
       if (err)
 	return err;
-      x += glyph->device_width;
     }
 
   grub_free (visual);
diff --git a/include/grub/unicode.h b/include/grub/unicode.h
index c96d8854d..b68c7faf5 100644
--- a/include/grub/unicode.h
+++ b/include/grub/unicode.h
@@ -130,13 +130,16 @@ grub_unicode_glyph_dup (const struct grub_unicode_glyph *in)
   if (!out)
     return NULL;
   grub_memcpy (out, in, sizeof (*in));
-  out->combining = grub_malloc (in->ncomb * sizeof (*in));
-  if (!out->combining)
+  if (in->combining)
     {
-      grub_free (out);
-      return NULL;
+      out->combining = grub_malloc (in->ncomb * sizeof (*in));
+      if (!out->combining)
+	{
+	  grub_free (out);
+	  return NULL;
+	}
+      grub_memcpy (out->combining, in->combining, in->ncomb * sizeof (*in));
     }
-  grub_memcpy (out->combining, in->combining, in->ncomb * sizeof (*in));
   return out;
 }
 
diff --git a/normal/charset.c b/normal/charset.c
index 452057174..2473f1b52 100644
--- a/normal/charset.c
+++ b/normal/charset.c
@@ -282,7 +282,8 @@ grub_utf8_to_ucs4_alloc (const char *msg, grub_uint32_t **unicode_msg,
   msg_len = grub_utf8_to_ucs4 (*unicode_msg, msg_len,
   			      (grub_uint8_t *) msg, -1, 0);
 
-  *last_position = *unicode_msg + msg_len;
+  if (last_position)
+    *last_position = *unicode_msg + msg_len;
 
   return msg_len;
 }
@@ -529,13 +530,14 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen,
 	      || comb_type == GRUB_UNICODE_COMB_ME
 	      || comb_type == GRUB_UNICODE_COMB_MN)
 	    last_comb_pointer = out->ncomb;
-	  n = grub_realloc (out->combining, 
+	  n = grub_realloc (out->combining,
 			    sizeof (n[0]) * (out->ncomb + 1));
 	  if (!n)
 	    {
 	      grub_errno = GRUB_ERR_NONE;
 	      continue;
 	    }
+	  out->combining = n;
 
 	  for (j = last_comb_pointer; j < out->ncomb; j++)
 	    if (out->combining[j].type > comb_type)