[unsafe-to-break] Fix Use-of-uninitialized-value in unsafe_to_break_set_mask

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3011

diff --git a/src/hb-ot-shape-complex-hangul.cc b/src/hb-ot-shape-complex-hangul.cc
index a90af3fd52ce3bf6ab0e389c7b0a11a44b817448..0e74802ee52884b1f3f3272fa53b7c50ba3f0bd5 100644 (file)
--- a/src/hb-ot-shape-complex-hangul.cc
+++ b/src/hb-ot-shape-complex-hangul.cc
@@ -372,7 +372,7 @@ preprocess_text_hangul (const hb_ot_shape_plan_t *plan,
            buffer->merge_out_clusters (start, end);
          continue;
        }
-       else if (!tindex)
+       else if ((!tindex && buffer->idx + 1 < count && isT (buffer->cur(+1).codepoint)))
          buffer->unsafe_to_break (buffer->idx, buffer->idx + 2); /* Mark unsafe between LV and T. */
       }