[GSUB] Fix context_length handling in Ligature too

diff --git a/src/hb-ot-layout-gsub-private.h b/src/hb-ot-layout-gsub-private.h
index a65a35183f35c3b694f000fe3eb7ec4b836aef31..9f0b0d8ddc77d2912603eb2aeec866b024da480a 100644 (file)
--- a/src/hb-ot-layout-gsub-private.h
+++ b/src/hb-ot-layout-gsub-private.h
@@ -318,14 +318,13 @@ struct Ligature {
 
     unsigned int i, j;
     unsigned int count = component.len;
-
-    if (HB_UNLIKELY (buffer->in_pos + count > buffer->in_length ||
-                    context_length < count))
-      return false; /* Not enough glyphs in input or context */
+    unsigned int end = MIN (buffer->in_length, buffer->in_pos + context_length);
+    if (HB_UNLIKELY (buffer->in_pos + count > end))
+      return false;
 
     for (i = 1, j = buffer->in_pos + 1; i < count; i++, j++) {
       while (!_hb_ot_layout_check_glyph_property (layout, IN_ITEM (j), lookup_flag, &property)) {
-       if (HB_UNLIKELY (j + count - i == buffer->in_length))
+       if (HB_UNLIKELY (j + count - i == end))
          return false;
        j++;
       }

diff --git a/src/hb-ot-layout-gsubgpos-private.h b/src/hb-ot-layout-gsubgpos-private.h
index f5b900f0753db00685eab4a0a4115eca23bb22c5..f9a1f6bc19c82b30f11af345d6a3c2f65de2bb30 100644 (file)
--- a/src/hb-ot-layout-gsubgpos-private.h
+++ b/src/hb-ot-layout-gsubgpos-private.h
@@ -221,7 +221,7 @@ static inline bool context_lookup (LOOKUP_ARGS_DEF,
 {
   /* First guess */
   if (HB_UNLIKELY (buffer->in_pos + inputCount > buffer->in_length ||
-                  context_length < inputCount))
+                  inputCount > context_length))
     return false;
 
   return match_input (LOOKUP_ARGS,
@@ -435,7 +435,8 @@ static inline bool chain_context_lookup (LOOKUP_ARGS_DEF,
 {
   /* First guess */
   if (HB_UNLIKELY (buffer->out_pos < backtrackCount ||
-                  buffer->in_pos + inputCount + lookaheadCount > buffer->in_length))
+                  buffer->in_pos + inputCount + lookaheadCount > buffer->in_length ||
+                  inputCount + lookaheadCount > context_length))
     return false;
 
   unsigned int offset;