From 11703afce6cebbb4c5e7cdea59ca59a1787608b8 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Mon, 15 Oct 2018 21:16:58 -0700
Subject: [PATCH] [kerx] Fix Format6 sanitize

Fixes https://oss-fuzz.com/v2/testcase-detail/5650286710882304
---
 src/hb-aat-layout-kerx-table.hh | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index aa8039771..830778786 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -513,17 +513,18 @@ struct KerxSubTableFormat6
   inline bool sanitize (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
+    printf ("%d\n", c->check_struct (this));
     return_trace (likely (c->check_struct (this) &&
-			  is_long () ?
-			  (
-			    u.l.rowIndexTable.sanitize (c, this) &&
-			    u.l.columnIndexTable.sanitize (c, this) &&
-			    c->check_range (this, u.l.array)
-			  ) : (
-			    u.s.rowIndexTable.sanitize (c, this) &&
-			    u.s.columnIndexTable.sanitize (c, this) &&
-			    c->check_range (this, u.s.array)
-			  )));
+			  (is_long () ?
+			   (
+			     u.l.rowIndexTable.sanitize (c, this) &&
+			     u.l.columnIndexTable.sanitize (c, this) &&
+			     c->check_range (this, u.l.array)
+			   ) : (
+			     u.s.rowIndexTable.sanitize (c, this) &&
+			     u.s.columnIndexTable.sanitize (c, this) &&
+			     c->check_range (this, u.s.array)
+			   ))));
   }
 
   struct accelerator_t