[AAT] Fully sanitize ankr table at sanitize time
Third try to fix access. Followup 6879efc2c1596d11a6a6ad296f80063b558d5e0f
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12532
Fixes https://bugs.chromium.org/p/chromium/issues/detail?id=922303
diff --git a/src/hb-aat-layout-ankr-table.hh b/src/hb-aat-layout-ankr-table.hh
index 69e2706..77873dd 100644
--- a/src/hb-aat-layout-ankr-table.hh
+++ b/src/hb-aat-layout-ankr-table.hh
@@ -65,14 +65,10 @@
unsigned int num_glyphs,
const char *end) const
{
- const Offset<HBUINT16, false> *offset = (this+lookupTable).get_value (glyph_id, num_glyphs);
+ const OffsetTo<GlyphAnchors, HBUINT16, false> *offset = (this+lookupTable).get_value (glyph_id, num_glyphs);
if (!offset)
return Null(Anchor);
- const GlyphAnchors &anchors = StructAtOffset<GlyphAnchors> (&(this+anchorData), *offset);
- if (unlikely (end < (const char *) &anchors ||
- end - (const char *) &anchors < anchors.len.static_size ||
- end - (const char *) &anchors < anchors.get_size ()))
- return Null(Anchor);
+ const GlyphAnchors &anchors = &(this+anchorData) + *offset;
return anchors[i];
}
@@ -81,14 +77,13 @@
TRACE_SANITIZE (this);
return_trace (likely (c->check_struct (this) &&
version == 0 &&
- lookupTable.sanitize (c, this) &&
- anchorData.sanitize (c, this) /* Just one byte. */));
+ lookupTable.sanitize (c, this, &(this+anchorData))));
}
protected:
HBUINT16 version; /* Version number (set to zero) */
HBUINT16 flags; /* Flags (currently unused; set to zero) */
- LOffsetTo<Lookup<Offset<HBUINT16, false> >, false>
+ LOffsetTo<Lookup<OffsetTo<GlyphAnchors, HBUINT16, false> >, false>
lookupTable; /* Offset to the table's lookup table */
LOffsetTo<HBUINT8, false>
anchorData; /* Offset to the glyph data table */
