[CBDT] Fix more offsetting issues

Fixes https://github.com/harfbuzz/harfbuzz/issues/960

dump-emoji still segfaults.  Needs debugging.

src/hb-ot-color-cbdt-table.hh

@@ -214,16 +214,14 @@ struct IndexSubtableRecord
     return (this+offsetToSubtable).get_extents (extents);
   }
 
-  bool get_image_data (unsigned int gid,
+  bool get_image_data (unsigned int  gid,
+		       const void   *base,
 		       unsigned int *offset,
 		       unsigned int *length,
 		       unsigned int *format) const
   {
-    if (gid < firstGlyphIndex || gid > lastGlyphIndex)
-    {
-      return false;
-    }
-    return (this+offsetToSubtable).get_image_data (gid - firstGlyphIndex,
+    if (gid < firstGlyphIndex || gid > lastGlyphIndex) return false;
+    return (base+offsetToSubtable).get_image_data (gid - firstGlyphIndex,
 						   offset, length, format);
   }
 
@@ -271,13 +269,15 @@ struct BitmapSizeTable
     TRACE_SANITIZE (this);
     return_trace (c->check_struct (this) &&
 		  indexSubtableArrayOffset.sanitize (c, base, numberOfIndexSubtables) &&
-		  c->check_range (&(base+indexSubtableArrayOffset), indexTablesSize) &&
 		  horizontal.sanitize (c) &&
 		  vertical.sanitize (c));
   }
 
-  const IndexSubtableRecord *find_table (hb_codepoint_t glyph, const void *base) const
+  const IndexSubtableRecord *find_table (hb_codepoint_t glyph,
+					 const void *base,
+					 const void **out_base) const
   {
+    *out_base = &(base+indexSubtableArrayOffset);
     return (base+indexSubtableArrayOffset).find_table (glyph, numberOfIndexSubtables);
   }
 
@@ -343,7 +343,8 @@ struct CBLC
 
   protected:
   const IndexSubtableRecord *find_table (hb_codepoint_t glyph,
-					 unsigned int *x_ppem, unsigned int *y_ppem) const
+					 unsigned int *x_ppem, unsigned int *y_ppem,
+					 const void **base) const
   {
     /* TODO: Make it possible to select strike. */
 
@@ -356,7 +357,7 @@ struct CBLC
       {
 	*x_ppem = sizeTables[i].ppemX;
 	*y_ppem = sizeTables[i].ppemY;
-	return sizeTables[i].find_table (glyph, this);
+	return sizeTables[i].find_table (glyph, this, base);
       }
     }
 
@@ -414,7 +415,8 @@ struct CBDT
       if (!cblc)
 	return false;  // Not a color bitmap font.
 
-      const IndexSubtableRecord *subtable_record = this->cblc->find_table(glyph, &x_ppem, &y_ppem);
+      const void *base;
+      const IndexSubtableRecord *subtable_record = this->cblc->find_table (glyph, &x_ppem, &y_ppem, &base);
       if (!subtable_record || !x_ppem || !y_ppem)
 	return false;
 
@@ -422,7 +424,7 @@ struct CBDT
 	return true;
 
       unsigned int image_offset = 0, image_length = 0, image_format = 0;
-      if (!subtable_record->get_image_data (glyph, &image_offset, &image_length, &image_format))
+      if (!subtable_record->get_image_data (glyph, base, &image_offset, &image_length, &image_format))
 	return false;
 
       {
@@ -473,7 +475,7 @@ struct CBDT
           {
             unsigned int image_offset = 0, image_length = 0, image_format = 0;
 
-            if (!subtable_record.get_image_data (gid,
+            if (!subtable_record.get_image_data (gid, &subtable_array,
                   &image_offset, &image_length, &image_format))
               continue;