From 8303a9b011eb2ab710371b9bd7d75693c7639bc1 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Wed, 26 Dec 2018 22:08:54 -0500
Subject: [PATCH] [Coverage] Ensure increasing coverage in iteration

---
 src/hb-ot-layout-common.hh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/hb-ot-layout-common.hh b/src/hb-ot-layout-common.hh
index 58868e831..bc8d6616e 100644
--- a/src/hb-ot-layout-common.hh
+++ b/src/hb-ot-layout-common.hh
@@ -994,15 +994,15 @@ struct CoverageFormat2
 	i++;
 	if (more ())
 	{
-	  hb_codepoint_t old = j;
+	  unsigned int old = coverage;
 	  j = c->rangeRecord[i].start;
-	  if (unlikely (j <= old))
+	  coverage = c->rangeRecord[i].value;
+	  if (unlikely (coverage <= old))
 	  {
 	    /* Broken table. Skip. Important to avoid DoS. */
 	   i = c->rangeRecord.len;
 	   return;
 	  }
-	  coverage = c->rangeRecord[i].value;
 	}
 	return;
       }