[AAT] Fully sanitize ankr table at sanitize time

Third try to fix access. Followup 6879efc2c1596d11a6a6ad296f80063b558d5e0f

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12532
Fixes https://bugs.chromium.org/p/chromium/issues/detail?id=922303

src/hb-aat-layout-ankr-table.hh

diff --git a/src/hb-aat-layout-ankr-table.hh b/src/hb-aat-layout-ankr-table.hh
index 69e2706..77873dd 100644
--- a/src/hb-aat-layout-ankr-table.hh
+++ b/src/hb-aat-layout-ankr-table.hh
@@ -65,14 +65,10 @@
 			    unsigned int num_glyphs,
 			    const char *end) const
   {
-    const Offset<HBUINT16, false> *offset = (this+lookupTable).get_value (glyph_id, num_glyphs);
+    const OffsetTo<GlyphAnchors, HBUINT16, false> *offset = (this+lookupTable).get_value (glyph_id, num_glyphs);
     if (!offset)
       return Null(Anchor);
-    const GlyphAnchors &anchors = StructAtOffset<GlyphAnchors> (&(this+anchorData), *offset);
-    if (unlikely (end < (const char *) &anchors ||
-		  end - (const char *) &anchors < anchors.len.static_size ||
-		  end - (const char *) &anchors < anchors.get_size ()))
-      return Null(Anchor);
+    const GlyphAnchors &anchors = &(this+anchorData) + *offset;
     return anchors[i];
   }
 
@@ -81,14 +77,13 @@
     TRACE_SANITIZE (this);
     return_trace (likely (c->check_struct (this) &&
 			  version == 0 &&
-			  lookupTable.sanitize (c, this) &&
-			  anchorData.sanitize (c, this) /* Just one byte. */));
+			  lookupTable.sanitize (c, this, &(this+anchorData))));
   }
 
   protected:
   HBUINT16	version; 	/* Version number (set to zero) */
   HBUINT16	flags;		/* Flags (currently unused; set to zero) */
-  LOffsetTo<Lookup<Offset<HBUINT16, false> >, false>
+  LOffsetTo<Lookup<OffsetTo<GlyphAnchors, HBUINT16, false> >, false>
 		lookupTable;	/* Offset to the table's lookup table */
   LOffsetTo<HBUINT8, false>
 		anchorData;	/* Offset to the glyph data table */