Disallow sanitize recursing into Extension subtables multiple times
Fixes https://oss-fuzz.com/v2/testcase-detail/5216838347653120
which is a stack overflow, not by way of infinite recursion, just
being deep. That's disallowed anyway, so catch it as it happens,
not afterwards.
diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
index 0023b31..a5cb105 100644
--- a/src/hb-ot-layout-gsubgpos-private.hh
+++ b/src/hb-ot-layout-gsubgpos-private.hh
@@ -2230,7 +2230,9 @@
inline bool sanitize (hb_sanitize_context_t *c) const
{
TRACE_SANITIZE (this);
- return_trace (c->check_struct (this) && extensionOffset != 0);
+ return_trace (c->check_struct (this) &&
+ extensionOffset != 0 &&
+ extensionLookupType != T::LookupSubTable::Extension);
}
protected:
