diff --git a/src/OT/glyf/SimpleGlyph.hh b/src/OT/glyf/SimpleGlyph.hh index 93b457cb0..b03b172fc 100644 --- a/src/OT/glyf/SimpleGlyph.hh +++ b/src/OT/glyf/SimpleGlyph.hh @@ -171,6 +171,7 @@ struct SimpleGlyph const HBUINT8 *p = &StructAtOffset (&endPtsOfContours[num_contours + 1], endPtsOfContours[num_contours]); + if (unlikely ((const char *) p < bytes.arrayZ)) return false; /* Unlikely overflow */ const HBUINT8 *end = (const HBUINT8 *) (bytes.arrayZ + bytes.length); /* Read flags */