From 75622b0d246eefe5d912a6918d14c7250ebaea78 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Fri, 28 Feb 2020 14:11:48 -0800
Subject: [PATCH] [subset] Limit the number of features processed in the
 feature closure.

---
 src/hb-ot-layout-gsubgpos.hh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh
index 607307633..ccad1a4c5 100644
--- a/src/hb-ot-layout-gsubgpos.hh
+++ b/src/hb-ot-layout-gsubgpos.hh
@@ -3104,7 +3104,8 @@ struct GSUBGPOS
   void closure_features (const hb_map_t *lookup_indexes, /* IN */
 			 hb_set_t       *feature_indexes /* OUT */) const
   {
-    for (unsigned i = 0; i < get_feature_count (); i++)
+    unsigned int feature_count = hb_min (get_feature_count (), (unsigned) HB_MAX_FEATURE_INDICES);
+    for (unsigned i = 0; i < feature_count; i++)
     {
       if (get_feature (i).intersects_lookup_indexes (lookup_indexes))
         feature_indexes->add (i);