diff --git a/src/hb-ot-hdmx-table.hh b/src/hb-ot-hdmx-table.hh index dea2b7e29..a86cc3c31 100644 --- a/src/hb-ot-hdmx-table.hh +++ b/src/hb-ot-hdmx-table.hh @@ -156,6 +156,7 @@ struct hdmx TRACE_SANITIZE (this); return_trace (c->check_struct (this) && !hb_unsigned_mul_overflows (numRecords, sizeDeviceRecord) && + min_size + numRecords * sizeDeviceRecord > numRecords * sizeDeviceRecord && sizeDeviceRecord >= DeviceRecord::min_size && c->check_range (this, get_size ())); } diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4877336988483584 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4877336988483584 new file mode 100644 index 000000000..73d4e5de7 Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-4877336988483584 differ