shithub: neatmkfn

Info  •  Files  •  Log

otf: handle bad GSUB format 1 tables

Reported and tested by Nils Reuße <n.reusse@hxgn.net>.

--- a/otf.c

+++ b/otf.c

@@ -610,12 +610,12 @@

 	cov = coverage(sub + U16(sub, 2), &ncov);

 	if (fmt == 1) {

 		for (i = 0; i < ncov; i++) {

-			if (cov[i] + S16(sub, 4) >= glyph_n)

+			int dst = cov[i] + S16(sub, 4);

+			if (dst >= glyph_n || dst < 0)

 				continue;

 			printf("gsub %s %d", feat, 2 + gctx_len(ctx, 1));

 			gctx_backtrack(ctx);

-			printf(" -%s +%s", glyph_name[cov[i]],

-				glyph_name[cov[i] + S16(sub, 4)]);

+			printf(" -%s +%s", glyph_name[cov[i]], glyph_name[dst]);

 			gctx_lookahead(ctx, 1);

 			printf("\n");

 		}