diff options
| author | Behdad Esfahbod <behdad@behdad.org> | 2018-10-13 13:48:22 -0400 |
|---|---|---|
| committer | Behdad Esfahbod <behdad@behdad.org> | 2018-10-13 13:48:22 -0400 |
| commit | de6e414c565de5f27b9da8c7b8b11f88659a4c42 (patch) | |
| tree | 1a4811b51123d6cf2356b4d9e218067a4269a05a | |
| parent | 71f76f2f39c88998b430b171c99b85818d4fa0ab (diff) | |
[kerx] Sanitize more
| -rw-r--r-- | src/hb-aat-layout-kerx-table.hh | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh index 95dd50dd..52923a8d 100644 --- a/src/hb-aat-layout-kerx-table.hh +++ b/src/hb-aat-layout-kerx-table.hh @@ -256,7 +256,8 @@ struct KerxSubTableFormat2 TRACE_SANITIZE (this); return_trace (likely (rowWidth.sanitize (c) && leftClassTable.sanitize (c, this) && - rightClassTable.sanitize (c, this))); + rightClassTable.sanitize (c, this) && + c->check_range (this, array))); } struct accelerator_t @@ -516,10 +517,12 @@ struct KerxSubTableFormat6 is_long () ? ( u.l.rowIndexTable.sanitize (c, this) && - u.l.columnIndexTable.sanitize (c, this) + u.l.columnIndexTable.sanitize (c, this) && + c->check_range (this, u.l.array) ) : ( u.s.rowIndexTable.sanitize (c, this) && - u.s.columnIndexTable.sanitize (c, this) + u.s.columnIndexTable.sanitize (c, this) && + c->check_range (this, u.s.array) ))); } |