From: Behdad Esfahbod <behdad@behdad.org>
Date: Thu, 2 May 2019 22:12:07 +0000 (-0700)
Subject: [serialize] Check offset base is within (possibly end of) object
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=91176d5b778b44172591e82ba84127e5eff1372d;p=platform%2Fupstream%2FlibHarfBuzzSharp.git

[serialize] Check offset base is within (possibly end of) object
---

diff --git a/src/hb-serialize.hh b/src/hb-serialize.hh
index 9fa0658..e7c6445 100644
--- a/src/hb-serialize.hh
+++ b/src/hb-serialize.hh
@@ -295,6 +295,7 @@ struct hb_serialize_context_t
       {
         const object_t::link_t &link = *link_it;
 	const object_t &child = *packed[link.objidx];
+	assert (link.bias <= parent.tail - parent.head);
 	unsigned offset = (child.head - parent.head) - link.bias;
 
 	if (link.is_wide)