From 0290bd2201ed513afcc0c511ee80fae088f8681b Mon Sep 17 00:00:00 2001
From: bae <unknown>
Date: Wed, 10 Jul 2019 18:21:59 +0100
Subject: [PATCH] 8219020: Table alternate substitutions Reviewed-by: mbalao

---
 .../native/sun/font/layout/AlternateSubstSubtables.cpp    | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/share/native/sun/font/layout/AlternateSubstSubtables.cpp b/src/share/native/sun/font/layout/AlternateSubstSubtables.cpp
index f296e89d3..b27d4ee50 100644
--- a/src/share/native/sun/font/layout/AlternateSubstSubtables.cpp
+++ b/src/share/native/sun/font/layout/AlternateSubstSubtables.cpp
@@ -50,7 +50,13 @@ le_uint32 AlternateSubstitutionSubtable::process(const LEReferenceTo<AlternateSu
         le_uint16 altSetCount = SWAPW(alternateSetCount);
 
         if (coverageIndex < altSetCount) {
-            Offset alternateSetTableOffset = SWAPW(alternateSetTableOffsetArray[coverageIndex]);
+            const LEReferenceToArrayOf<Offset>
+                arrayRef(base, success, alternateSetTableOffsetArray, altSetCount);
+            if (!LE_SUCCESS(success)) return 0;
+
+            Offset alternateSetTableOffset = SWAPW(arrayRef.getObject(coverageIndex, success));
+            if (!LE_SUCCESS(success)) return 0;
+
             const LEReferenceTo<AlternateSetTable> alternateSetTable(base, success,
                                   (const AlternateSetTable *) ((char *) this + alternateSetTableOffset));
             if (!LE_SUCCESS(success)) return 0;
-- 
GitLab