[avar2] Fix mapping when coords length don't match

Ouch.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49407
This commit is contained in:
Behdad Esfahbod 2022-07-23 10:50:26 -06:00
parent 06c3ec0a19
commit 32c85b8c8c
2 changed files with 3 additions and 0 deletions

View File

@ -186,6 +186,9 @@ struct avar
if (version.major < 2)
return;
for (; count < axisCount; count++)
map = &StructAfter<SegmentMaps> (*map);
const auto &v2 = * (const avarV2Tail *) map;
const auto &varidx_map = this+v2.varIdxMap;