[name] Sanitize records for reals

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14641

diff --git a/src/hb-ot-name-table.hh b/src/hb-ot-name-table.hh
index 4e4da74..1c8f544 100644 (file)
--- a/src/hb-ot-name-table.hh
+++ b/src/hb-ot-name-table.hh
@@ -220,7 +220,6 @@ struct name
   {
     TRACE_SANITIZE (this);
     const void *string_pool = (this+stringOffset).arrayZ;
-    /* TODO: Move to run-time?! */
     return_trace (nameRecordZ.sanitize (c, count, string_pool));
   }
 
@@ -230,7 +229,8 @@ struct name
     return_trace (c->check_struct (this) &&
                  likely (format == 0 || format == 1) &&
                  c->check_array (nameRecordZ.arrayZ, count) &&
-                 c->check_range (this, stringOffset));
+                 c->check_range (this, stringOffset) &&
+                 sanitize_records (c));
   }
 
   struct accelerator_t