commit dd71d2c1c30ca85ddd7b1d7e3a9e2bbdacd6ae7a
author Behdad Esfahbod <behdad@behdad.org> Fri May 06 13:02:26 2022 -0600
committer Behdad Esfahbod <behdad@behdad.org> Fri May 06 13:02:26 2022 -0600
tree 3aa991b7313643724ba090f95b6906ee36bd16c4
parent 9a6dabd61a1af848abbab21b0152e58875604a37

[gvar] Protect against offset underflow

src/hb-ot-var-gvar-table.hh

diff --git a/src/hb-ot-var-gvar-table.hh b/src/hb-ot-var-gvar-table.hh
index dedcc3d..3b2a38b 100644
--- a/src/hb-ot-var-gvar-table.hh
+++ b/src/hb-ot-var-gvar-table.hh
@@ -479,7 +479,9 @@
   const hb_bytes_t get_glyph_var_data_bytes (hb_blob_t *blob, hb_codepoint_t glyph) const
   {
     unsigned start_offset = get_offset (glyph);
-    unsigned length = get_offset (glyph+1) - start_offset;
+    unsigned end_offset = get_offset (glyph+1);
+    if (unlikely (end_offset < start_offset)) return hb_bytes_t ();
+    unsigned length = end_offset - start_offset;
     hb_bytes_t var_data = blob->as_bytes ().sub_array (((unsigned) dataZ) + start_offset, length);
     return likely (var_data.length >= GlyphVariationData::min_size) ? var_data : hb_bytes_t ();
   }