From c8a2dc820eb0ee3124e3762cb1167ac9e528ad28 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Sat, 24 Nov 2018 22:16:53 -0500
Subject: [PATCH] Revert "[aat.kerx] Remove kerx subtable boundary enforcement"

This reverts commit 15905a2a2998f7ddd964f920a4828602235d6b00.
---
 src/hb-aat-layout-kerx-table.hh | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index b5c1e1d1f..fbeb35b0c 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -926,6 +926,12 @@ struct KerxTable
       if (reverse)
 	c->buffer->reverse ();
 
+      /* See comment in sanitize() for conditional here. */
+      if (i < count - 1)
+	c->sanitizer.set_object (*st);
+      else
+	c->sanitizer.reset_object ();
+
       ret |= st->dispatch (c);
 
       if (reverse)
@@ -937,6 +943,7 @@ struct KerxTable
       st = &StructAfter<SubTable> (*st);
       c->set_lookup_index (c->lookup_index + 1);
     }
+    c->sanitizer.reset_object ();
 
     return ret;
   }
@@ -955,10 +962,24 @@ struct KerxTable
     unsigned int count = thiz()->tableCount;
     for (unsigned int i = 0; i < count; i++)
     {
+      c->reset_object ();
+      if (unlikely (!st->u.header.sanitize (c)))
+	return_trace (false);
+      /* OpenType kern table has 2-byte subtable lengths.  That's limiting.
+       * MS implementation also only supports one subtable, of format 0,
+       * anyway.  Certain versions of some fonts, like Calibry, contain
+       * kern subtable that exceeds 64kb.  Looks like, the subtable length
+       * is simply ignored.  Which makes sense.  It's only needed if you
+       * have multiple subtables.  To handle such fonts, we just ignore
+       * the length for the last subtable. */
+      if (i < count - 1)
+	c->set_object (*st);
+
       if (unlikely (!st->sanitize (c)))
 	return_trace (false);
       st = &StructAfter<SubTable> (*st);
     }
+    c->reset_object ();
 
     return_trace (true);
   }