[gsub] Don't substitute in ReverseChainSingleSubstFormat1 if missing substitute

Fixes https://github.com/harfbuzz/harfbuzz/issues/2467
5 years ago · 41ef75f64a
parent e7c79e16b8
commit 41ef75f64a
1 changed files with 3 additions and 1 deletions
--- a/src/hb-ot-layout-gsub-table.hh
+++ b/src/hb-ot-layout-gsub-table.hh
@ -1205,7 +1205,9 @@ struct ReverseChainSingleSubstFormat1
    const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage>> (backtrack);
    const ArrayOf<HBGlyphID> &substitute = StructAfter<ArrayOf<HBGlyphID>> (lookahead);

-  unsigned int start_index = 0, end_index = 0;
+    if (unlikely (index >= substitute.len)) return_trace (false);
+
+    unsigned int start_index = 0, end_index = 0;
    if (match_backtrack (c,
 			 backtrack.len, (HBUINT16 *) backtrack.arrayZ,
 			 match_coverage, this,