diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh index cf6afb5c6..6969d7870 100644 --- a/src/hb-ot-layout-gsubgpos.hh +++ b/src/hb-ot-layout-gsubgpos.hh @@ -2777,13 +2777,19 @@ struct ChainContextFormat2 hb_map_t backtrack_klass_map; out->backtrackClassDef.serialize_subset (c, backtrackClassDef, this, &backtrack_klass_map); + if (unlikely (!c->serializer->check_success (!backtrack_klass_map.in_error ()))) + return_trace (false); // subset inputClassDef based on glyphs survived in Coverage subsetting hb_map_t input_klass_map; out->inputClassDef.serialize_subset (c, inputClassDef, this, &input_klass_map); + if (unlikely (!c->serializer->check_success (!input_klass_map.in_error ()))) + return_trace (false); hb_map_t lookahead_klass_map; out->lookaheadClassDef.serialize_subset (c, lookaheadClassDef, this, &lookahead_klass_map); + if (unlikely (!c->serializer->check_success (!lookahead_klass_map.in_error ()))) + return_trace (false); unsigned non_zero_index = 0, index = 0; bool ret = true; diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4880059756969984 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4880059756969984 new file mode 100644 index 000000000..0a0f649ca Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4880059756969984 differ