[GPOS] Fix div-by-zero

Patch by Jonathan Kew.  Mozilla bug #465728.

diff --git a/src/hb-ot-layout-gpos-private.hh b/src/hb-ot-layout-gpos-private.hh
index 3b40bdc6b54533da9cd95446b36e1227974c337b..a5f65b482fd001dac7cadbbbc5a8d22064f65a27 100644 (file)
--- a/src/hb-ot-layout-gpos-private.hh
+++ b/src/hb-ot-layout-gpos-private.hh
@@ -345,7 +345,7 @@ struct AnchorMatrix
   inline bool sanitize (hb_sanitize_context_t *c, unsigned int cols) {
     TRACE_SANITIZE ();
     if (!c->check_struct (this)) return false;
-    if (unlikely (cols >= ((unsigned int) -1) / rows)) return false;
+    if (unlikely (rows > 0 && cols >= ((unsigned int) -1) / rows)) return false;
     unsigned int count = rows * cols;
     if (!c->check_array (matrix, matrix[0].static_size, count)) return false;
     for (unsigned int i = 0; i < count; i++)