diff --git a/src/hb-ot-layout-gpos-table.hh b/src/hb-ot-layout-gpos-table.hh index 0e389b761..e4189754f 100644 --- a/src/hb-ot-layout-gpos-table.hh +++ b/src/hb-ot-layout-gpos-table.hh @@ -492,9 +492,13 @@ struct Anchor { TRACE_SUBSET (this); if (c->plan->drop_hints) + { // AnchorFormat 2 and 3 just containing extra hinting information, so // if hints are being dropped convert to format 1. + if (u.format != 1 && u.format != 2 && u.format != 3) + return_trace (false); return_trace (bool (reinterpret_cast (u.format1.copy (c->serializer)))); + } switch (u.format) { case 1: return_trace (bool (reinterpret_cast (u.format1.copy (c->serializer)))); diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5858518134554624 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5858518134554624 new file mode 100644 index 000000000..90a743b9f Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5858518134554624 differ