Limit OT::Lookup subtables (#2219)

Fixes https://crbug.com/oss-fuzz/13943

src/hb-sanitize.hh

diff --git a/src/hb-sanitize.hh b/src/hb-sanitize.hh
index 310e2fc..8f6453b 100644
--- a/src/hb-sanitize.hh
+++ b/src/hb-sanitize.hh
@@ -113,6 +113,9 @@
 #ifndef HB_SANITIZE_MAX_OPS_MAX
 #define HB_SANITIZE_MAX_OPS_MAX 0x3FFFFFFF
 #endif
+#ifndef HB_SANITIZE_MAX_SUTABLES
+#define HB_SANITIZE_MAX_SUTABLES 0x4000
+#endif
 
 struct hb_sanitize_context_t :
        hb_dispatch_context_t<hb_sanitize_context_t, bool, HB_DEBUG_SANITIZE>
@@ -120,7 +123,7 @@
   hb_sanitize_context_t () :
 	debug_depth (0),
 	start (nullptr), end (nullptr),
-	max_ops (0),
+	max_ops (0), max_subtables (0),
 	writable (false), edit_count (0),
 	blob (nullptr),
 	num_glyphs (65536),
@@ -134,6 +137,12 @@
   static return_t no_dispatch_return_value () { return false; }
   bool stop_sublookup_iteration (const return_t r) const { return !r; }
 
+  bool visit_subtables (unsigned count)
+  {
+    max_subtables += count;
+    return max_subtables < HB_SANITIZE_MAX_SUTABLES;
+  }
+
   private:
   template <typename T, typename ...Ts> auto
   _dispatch (const T &obj, hb_priority<1>, Ts&&... ds) HB_AUTO_RETURN
@@ -380,7 +389,7 @@
 
   mutable unsigned int debug_depth;
   const char *start, *end;
-  mutable int max_ops;
+  mutable int max_ops, max_subtables;
   private:
   bool writable;
   unsigned int edit_count;