From 9552f4ef0da0b7e1fb28cb2738b865888e7941d9 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Fri, 23 Nov 2018 15:24:17 -0500
Subject: [PATCH] [kern] Don't enforce length of last subtable

---
 src/hb-aat-layout-kerx-table.hh | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index 74fecbb11..c60f29a68 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -936,7 +936,11 @@ struct KerxTable
       if (reverse)
 	c->buffer->reverse ();
 
-      c->sanitizer.set_object (*st);
+      /* See comment in sanitize() for conditional here. */
+      if (i < count - 1)
+	c->sanitizer.set_object (*st);
+      else
+	c->sanitizer.reset_object ();
 
       ret |= st->dispatch (c);
 
@@ -968,7 +972,18 @@ struct KerxTable
     unsigned int count = thiz()->tableCount;
     for (unsigned int i = 0; i < count; i++)
     {
-      c->set_object (*st);
+      /* OpenType kern table has 2-byte subtable lengths.  That's limiting.
+       * MS implementation also only supports one subtable, of format 0,
+       * anyway.  Certain versions of some fonts, like Calibry, contain
+       * kern subtable that exceeds 64kb.  Looks like, the subtable length
+       * is simply ignored.  Which makes sense.  It's only needed if you
+       * have multiple subtables.  To handle such fonts, we just ignore
+       * the length for the last subtable. */
+      if (i < count - 1)
+	c->set_object (*st);
+      else
+	c->reset_object ();
+
       if (unlikely (!st->sanitize (c)))
 	return_trace (false);
       st = &StructAfter<SubTable> (*st);