From 2f556c38c08d6d19bed115cc5ab5e0e369d9b4d0 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 13 Mar 2020 12:21:10 -0700
Subject: [PATCH] [subset] Fix crash when serializer runs out of room during
 gpos subsetting.

---
 src/hb-ot-layout-gpos-table.hh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/hb-ot-layout-gpos-table.hh b/src/hb-ot-layout-gpos-table.hh
index ed6ec03b9..aa5857275 100644
--- a/src/hb-ot-layout-gpos-table.hh
+++ b/src/hb-ot-layout-gpos-table.hh
@@ -485,6 +485,7 @@ struct AnchorMatrix
     for (const unsigned i : index_iter)
     {
       auto *offset = c->embed (offset_matrix->matrixZ[i]);
+      if (!offset) return_trace (false);
       offset->serialize_copy (c, offset_matrix->matrixZ[i], offset_matrix, c->to_bias (this));
     }