[subset] Limit the number of scripts and langsys' that should be checked when collecting features.

src/hb-ot-layout-common.hh

diff --git a/src/hb-ot-layout-common.hh b/src/hb-ot-layout-common.hh
index 7663bd3..7b1d39a 100644
--- a/src/hb-ot-layout-common.hh
+++ b/src/hb-ot-layout-common.hh
@@ -51,6 +51,14 @@
 #define HB_CLOSURE_MAX_STAGES	32
 #endif
 
+#ifndef HB_MAX_SCRIPTS
+#define HB_MAX_SCRIPTS	500
+#endif
+
+#ifndef HB_MAX_LANGSYS
+#define HB_MAX_LANGSYS	2000
+#endif
+
 
 namespace OT {
 

src/hb-ot-layout.cc

diff --git a/src/hb-ot-layout.cc b/src/hb-ot-layout.cc
index a8cfcf5..18c8107 100644
--- a/src/hb-ot-layout.cc
+++ b/src/hb-ot-layout.cc
@@ -668,7 +668,8 @@
 				 hb_tag_t         table_tag,
 				 hb_set_t        *feature_indexes_)
     : g (get_gsubgpos_table (face, table_tag)),
-      feature_indexes (feature_indexes_) {}
+      feature_indexes (feature_indexes_),
+      langsys_count(0), script_count(0) {}
 
   bool inline visited (const OT::Script &s)
   {
@@ -678,6 +679,9 @@
 		  !s.get_lang_sys_count ()))
       return true;
 
+    if (script_count++ > HB_MAX_SCRIPTS)
+      return true;
+
     return visited (s, visited_script);
   }
   bool inline visited (const OT::LangSys &l)
@@ -688,6 +692,9 @@
 		  !l.get_feature_count ()))
       return true;
 
+    if (langsys_count++ > HB_MAX_LANGSYS)
+      return true;
+
     return visited (l, visited_langsys);
   }
 
@@ -710,6 +717,8 @@
   private:
   hb_set_t visited_script;
   hb_set_t visited_langsys;
+  unsigned int script_count;
+  unsigned int langsys_count;
 };
 
 static void