diff --git a/src/hb-font.cc b/src/hb-font.cc
index 9aaefdebd..b22dc0150 100644
--- a/src/hb-font.cc
+++ b/src/hb-font.cc
@@ -165,11 +165,8 @@ static hb_blob_t *
 _hb_face_get_table_from_blob (hb_tag_t tag, void *user_data)
 {
   hb_face_t *face = (hb_face_t *) user_data;
-  const char *data = hb_blob_lock (face->blob);
 
-  /* XXX sanitize */
-
-  const OpenTypeFontFile &ot_file = OpenTypeFontFile::get_for_data (data);
+  const OpenTypeFontFile &ot_file = Sanitizer<OpenTypeFontFile>::lock_instance (face->blob);
   const OpenTypeFontFace &ot_face = ot_file.get_face (face->index);
 
   const OpenTypeTable &table = ot_face.get_table_by_tag (tag);
@@ -226,7 +223,7 @@ hb_face_create_for_data (hb_blob_t    *blob,
   if (!HB_OBJECT_DO_CREATE (hb_face_t, face))
     return &_hb_face_nil;
 
-  face->blob = hb_blob_reference (blob);
+  face->blob = Sanitizer<OpenTypeFontFile>::sanitize (hb_blob_reference (blob));
   face->index = index;
   face->get_table = _hb_face_get_table_from_blob;
   face->user_data = face;
diff --git a/src/hb-open-types-private.hh b/src/hb-open-types-private.hh
index 1ec7d1ebc..1af7c08a2 100644
--- a/src/hb-open-types-private.hh
+++ b/src/hb-open-types-private.hh
@@ -304,7 +304,7 @@ struct Sanitizer
     }
   }
 
-  static const Type& instantiate (hb_blob_t *blob) {
+  static const Type& lock_instance (hb_blob_t *blob) {
     return Type::get_for_data (hb_blob_lock (blob));
   }
 };
diff --git a/src/hb-ot-layout.cc b/src/hb-ot-layout.cc
index ef0a6b127..8699e40fa 100644
--- a/src/hb-ot-layout.cc
+++ b/src/hb-ot-layout.cc
@@ -46,14 +46,14 @@ _hb_ot_layout_init (hb_face_t *face)
 
   /* XXX sanitize */
 
-  layout->gdef_blob = hb_face_get_table (face, HB_OT_TAG_GDEF);
-  layout->gdef = &GDEF::get_for_data (hb_blob_lock (layout->gdef_blob));
+  layout->gdef_blob = Sanitizer<GDEF>::sanitize (hb_face_get_table (face, HB_OT_TAG_GDEF));
+  layout->gdef = &Sanitizer<GDEF>::lock_instance (layout->gdef_blob);
 
-  layout->gsub_blob = hb_face_get_table (face, HB_OT_TAG_GSUB);
-  layout->gsub = &GSUB::get_for_data (hb_blob_lock (layout->gsub_blob));
+  layout->gsub_blob = Sanitizer<GSUB>::sanitize (hb_face_get_table (face, HB_OT_TAG_GSUB));
+  layout->gsub = &Sanitizer<GSUB>::lock_instance (layout->gsub_blob);
 
-  layout->gpos_blob = hb_face_get_table (face, HB_OT_TAG_GPOS);
-  layout->gpos = &GPOS::get_for_data (hb_blob_lock (layout->gpos_blob));
+  layout->gpos_blob = Sanitizer<GPOS>::sanitize (hb_face_get_table (face, HB_OT_TAG_GPOS));
+  layout->gpos = &Sanitizer<GPOS>::lock_instance (layout->gpos_blob);
 }
 
 void