diff --git a/src/hb-ot-var-avar-table.hh b/src/hb-ot-var-avar-table.hh index 18510d36a..5946aef63 100644 --- a/src/hb-ot-var-avar-table.hh +++ b/src/hb-ot-var-avar-table.hh @@ -186,6 +186,9 @@ struct avar if (version.major < 2) return; + for (; count < axisCount; count++) + map = &StructAfter (*map); + const auto &v2 = * (const avarV2Tail *) map; const auto &varidx_map = this+v2.varIdxMap; diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-4523349576908800 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-4523349576908800 new file mode 100644 index 000000000..d66fb2af5 Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-4523349576908800 differ