[otlayout] Avoid invalid access with Context format 3.
Backport https://github.com/behdad/harfbuzz/commit/9df0a520 to our
present copy of HarfBuzz to fix a potential crasher.
Bug: 18789351
Change-Id: I89fc1dd7f9fd57f50babacea2b341a31e1bf41ee
diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
index 546ff4b..fc9eed0 100644
--- a/src/hb-ot-layout-gsubgpos-private.hh
+++ b/src/hb-ot-layout-gsubgpos-private.hh
@@ -1479,6 +1479,7 @@
TRACE_SANITIZE (this);
if (!c->check_struct (this)) return TRACE_RETURN (false);
unsigned int count = glyphCount;
+ if (!count) return TRACE_RETURN (false); /* We want to access coverage[0] freely. */
if (!c->check_array (coverage, coverage[0].static_size, count)) return TRACE_RETURN (false);
for (unsigned int i = 0; i < count; i++)
if (!coverage[i].sanitize (c, this)) return TRACE_RETURN (false);
@@ -2090,6 +2091,7 @@
if (!backtrack.sanitize (c, this)) return TRACE_RETURN (false);
OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
if (!input.sanitize (c, this)) return TRACE_RETURN (false);
+ if (!input.len) return TRACE_RETURN (false); /* To be consistent with Context. */
OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input);
if (!lookahead.sanitize (c, this)) return TRACE_RETURN (false);
ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
