From 924803166e074c569ecfa7e598686f334777770f Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Tue, 17 Apr 2018 15:32:02 +0200
Subject: [PATCH] [colr] Check layer record access

---
 src/hb-ot-color-colr-table.hh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/hb-ot-color-colr-table.hh b/src/hb-ot-color-colr-table.hh
index 6e280a3d7..4d761fca0 100644
--- a/src/hb-ot-color-colr-table.hh
+++ b/src/hb-ot-color-colr-table.hh
@@ -110,13 +110,20 @@ struct COLR
     return true;
   }
 
-  inline void get_layer_record (unsigned int record,
+  inline bool get_layer_record (unsigned int record,
 				hb_codepoint_t *glyph_id /* OUT */,
 				unsigned int *palette_index /* OUT */) const
   {
+    if (unlikely (record >= numLayers))
+    {
+      *glyph_id = 0;
+      *palette_index = 0xFFFF;
+      return false;
+    }
     const LayerRecord &layer = (this+layersZ)[record];
     *glyph_id = layer.glyphid;
     *palette_index = layer.colorIdx;
+    return true;
   }
 
   protected: