From 6caf76f4a8b5e232a87b84dc5e357dddef63d00b Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Tue, 8 Jan 2019 23:28:05 -0800
Subject: [PATCH] Tighten Coverage iteration

---
 src/hb-ot-layout-common.hh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/hb-ot-layout-common.hh b/src/hb-ot-layout-common.hh
index 672775b58..b1627571c 100644
--- a/src/hb-ot-layout-common.hh
+++ b/src/hb-ot-layout-common.hh
@@ -1002,9 +1002,12 @@ struct CoverageFormat2
 	  unsigned int old = coverage;
 	  j = c->rangeRecord[i].start;
 	  coverage = c->rangeRecord[i].value;
-	  if (unlikely (coverage <= old))
+	  if (unlikely (coverage != old + 1))
 	  {
-	    /* Broken table. Skip. Important to avoid DoS. */
+	    /* Broken table. Skip. Important to avoid DoS.
+	     * Also, our callers depend on coverage being
+	     * consecutive and monotonically increasing,
+	     * ie. iota(). */
 	   i = c->rangeRecord.len;
 	   return;
 	  }