[subset] fail reference blob in face builder if allocation for table sorting fails.
Fixes https://oss-fuzz.com/testcase-detail/5041767803125760
diff --git a/src/hb-face.cc b/src/hb-face.cc
index 2386e87..2c00873 100644
--- a/src/hb-face.cc
+++ b/src/hb-face.cc
@@ -690,6 +690,12 @@
// Sort the tags so that produced face is deterministic.
hb_vector_t<hb_pair_t <hb_tag_t, hb_blob_t*>> sorted_entries;
data->tables.iter () | hb_sink (sorted_entries);
+ if (unlikely (sorted_entries.in_error ()))
+ {
+ hb_free (buf);
+ return nullptr;
+ }
+
sorted_entries.qsort (compare_entries);
bool ret = f->serialize_single (&c, sfnt_tag, + sorted_entries.iter());
diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5041767803125760 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5041767803125760
new file mode 100644
index 0000000..d23fa57
--- /dev/null
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5041767803125760
Binary files differ
