From ee9b0b6cb5fdb08671ab064f26c299135f828260 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Fri, 9 Oct 2015 14:23:15 -0400
Subject: [PATCH] Fix another sanitize bug

Also discovered by "libFuzzer".
---
 src/hb-open-type-private.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index aeb3302..e55d2e1 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -920,7 +920,7 @@ struct ArrayOf
   inline bool sanitize_shallow (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
-    return_trace (c->check_struct (this) && c->check_array (this, Type::static_size, len));
+    return_trace (c->check_struct (this) && c->check_array (array, Type::static_size, len));
   }
 
   public:
-- 
2.7.4