sanitize variationStore in CFF2 against its size

6 years ago · c31092ab34
parent d9dabc00e9
commit c31092ab34
1 changed files with 1 additions and 1 deletions
--- a/src/hb-ot-cff2-table.hh
+++ b/src/hb-ot-cff2-table.hh
@ -115,7 +115,7 @@ struct CFF2VariationStore
  inline bool sanitize (hb_sanitize_context_t *c) const
  {
    TRACE_SANITIZE (this);
-    return_trace (likely (c->check_struct (this)) && varStore.sanitize (c));
+    return_trace (likely (c->check_struct (this)) && c->check_range (&varStore, size) && varStore.sanitize (c));
  }
  inline bool serialize (hb_serialize_context_t *c, const CFF2VariationStore *varStore)