[kern] Don't enforce length of last subtable

src/hb-aat-layout-kerx-table.hh

@@ -936,7 +936,11 @@ struct KerxTable
       if (reverse)
 	c->buffer->reverse ();
 
+      /* See comment in sanitize() for conditional here. */
+      if (i < count - 1)
 	c->sanitizer.set_object (*st);
+      else
+	c->sanitizer.reset_object ();
 
       ret |= st->dispatch (c);
 
@@ -968,7 +972,18 @@ struct KerxTable
     unsigned int count = thiz()->tableCount;
     for (unsigned int i = 0; i < count; i++)
     {
+      /* OpenType kern table has 2-byte subtable lengths.  That's limiting.
+       * MS implementation also only supports one subtable, of format 0,
+       * anyway.  Certain versions of some fonts, like Calibry, contain
+       * kern subtable that exceeds 64kb.  Looks like, the subtable length
+       * is simply ignored.  Which makes sense.  It's only needed if you
+       * have multiple subtables.  To handle such fonts, we just ignore
+       * the length for the last subtable. */
+      if (i < count - 1)
 	c->set_object (*st);
+      else
+	c->reset_object ();
+
       if (unlikely (!st->sanitize (c)))
 	return_trace (false);
       st = &StructAfter<SubTable> (*st);