From 20edc70d537b01e8a384ee05673335f2f8a18238 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Sat, 24 Nov 2018 14:52:34 -0500
Subject: [PATCH] [morx/kerx] Fix sanitize regression

Broke in 8dcc1913a1670ede7b124f7b5b775d7ab8791386

If sanitizer is left with another object, it wouldn't work.

Better fix coming soon.
---
 src/hb-aat-layout-kerx-table.hh | 6 +-----
 src/hb-aat-layout-morx-table.hh | 4 +---
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index 2d5489324..fbeb35b0c 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -962,11 +962,9 @@ struct KerxTable
     unsigned int count = thiz()->tableCount;
     for (unsigned int i = 0; i < count; i++)
     {
+      c->reset_object ();
       if (unlikely (!st->u.header.sanitize (c)))
-      {
-	c->reset_object ();
 	return_trace (false);
-      }
       /* OpenType kern table has 2-byte subtable lengths.  That's limiting.
        * MS implementation also only supports one subtable, of format 0,
        * anyway.  Certain versions of some fonts, like Calibry, contain
@@ -976,8 +974,6 @@ struct KerxTable
        * the length for the last subtable. */
       if (i < count - 1)
 	c->set_object (*st);
-      else
-	c->reset_object ();
 
       if (unlikely (!st->sanitize (c)))
 	return_trace (false);
diff --git a/src/hb-aat-layout-morx-table.hh b/src/hb-aat-layout-morx-table.hh
index 5b44a4cfa..dc406f59f 100644
--- a/src/hb-aat-layout-morx-table.hh
+++ b/src/hb-aat-layout-morx-table.hh
@@ -1061,11 +1061,9 @@ struct Chain
     unsigned int count = subtableCount;
     for (unsigned int i = 0; i < count; i++)
     {
+      c->reset_object ();
       if (unlikely (!c->check_struct (subtable)))
-      {
-	c->reset_object ();
 	return_trace (false);
-      }
       c->set_object (*subtable);
       if (!subtable->sanitize (c))
 	return_trace (false);