[AAT] Fix mort ContextualSubtable offset access

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12312
2019-01-14 15:09:14 -05:00 · 2019-01-14 15:09:14 -05:00 · 7a6686a589
commit 7a6686a589
parent a3fa7d3336
2 changed files with 2 additions and 1 deletions
--- a/src/hb-aat-layout-morx-table.hh
+++ b/src/hb-aat-layout-morx-table.hh
@ -330,7 +330,8 @@ struct ContextualSubtable
    unsigned int num_entries = 0;
    if (unlikely (!machine.sanitize (c, &num_entries))) return_trace (false);

-    if (!Types::extended) return_trace (true);
+    if (!Types::extended)
+      return_trace (substitutionTables.sanitize (c, this, 0));

    unsigned int num_lookups = 0;

--- a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5631444412530688
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5631444412530688