[aat] Sanitize classTable in StateTable

7 years ago · 12fffce10e
parent e6263c7142
commit 12fffce10e
1 changed files with 2 additions and 1 deletions
--- a/src/hb-aat-layout-common-private.hh
+++ b/src/hb-aat-layout-common-private.hh
@ -550,7 +550,8 @@ struct StateTable
 			unsigned int *num_entries_out = nullptr) const
  {
    TRACE_SANITIZE (this);
-    if (unlikely (!c->check_struct (this))) return_trace (false);
+    if (unlikely (!(c->check_struct (this) &&
+		    classTable.sanitize (c, this)))) return_trace (false);

    const HBUINT16 *states = (this+stateArrayTable).arrayZ;
    const Entry<Extra> *entries = (this+entryTable).arrayZ;