diff --git a/src/share/native/sun/font/layout/ContextualSubstSubtables.cpp b/src/share/native/sun/font/layout/ContextualSubstSubtables.cpp
index 8beae2730aa7f80a18762b68231a4a1ded8b446c..c5c322076bb04f41e67a7f6d6fe07ef7c9dffeee 100644
--- a/src/share/native/sun/font/layout/ContextualSubstSubtables.cpp
+++ b/src/share/native/sun/font/layout/ContextualSubstSubtables.cpp
@@ -67,7 +67,10 @@ void ContextualSubstitutionBase::applySubstitutionLookups(
         le_uint16 lookupListIndex = SWAPW(substLookupRecordArrayPtr[subst].lookupListIndex);
 
         tempIterator.setCurrStreamPosition(position);
-        tempIterator.next(sequenceIndex);
+        if (!tempIterator.next(sequenceIndex)) {
+            success = LE_INTERNAL_ERROR;
+            return;
+        }
 
         lookupProcessor->applySingleLookup(lookupListIndex, &tempIterator, fontInstance, success);
     }
diff --git a/src/share/native/sun/font/layout/GlyphIterator.cpp b/src/share/native/sun/font/layout/GlyphIterator.cpp
index 87f6d597482c435253088f8aeb1c394a7dd8b665..eed52fc214c67cae7da3d686761bb3bbfc1b36ab 100644
--- a/src/share/native/sun/font/layout/GlyphIterator.cpp
+++ b/src/share/native/sun/font/layout/GlyphIterator.cpp
@@ -224,6 +224,16 @@ void GlyphIterator::getCursiveExitPoint(LEPoint &exitPoint) const
 
 void GlyphIterator::setCurrGlyphID(TTGlyphID glyphID)
 {
+    if (direction < 0) {
+        if (position <= nextLimit || position >= prevLimit) {
+            return;
+        }
+    } else {
+        if (position <= prevLimit || position >= nextLimit) {
+            return;
+        }
+    }
+
     LEGlyphID glyph = glyphStorage[position];
 
     glyphStorage[position] = LE_SET_GLYPH(glyph, glyphID);
diff --git a/src/share/native/sun/font/layout/SubstitutionLookups.cpp b/src/share/native/sun/font/layout/SubstitutionLookups.cpp
index 7103a3fbb3b238349304e6bb4c662c7c030e8c08..3a0e18f75d3d1308240a8b0f3765400821090c66 100644
--- a/src/share/native/sun/font/layout/SubstitutionLookups.cpp
+++ b/src/share/native/sun/font/layout/SubstitutionLookups.cpp
@@ -67,7 +67,10 @@ void SubstitutionLookup::applySubstitutionLookups(
         le_uint16 lookupListIndex = SWAPW(substLookupRecordArray[subst].lookupListIndex);
 
         tempIterator.setCurrStreamPosition(position);
-        tempIterator.next(sequenceIndex);
+        if (!tempIterator.next(sequenceIndex)) {
+            success = LE_INTERNAL_ERROR;
+            return;
+        }
 
         lookupProcessor->applySingleLookup(lookupListIndex, &tempIterator, fontInstance, success);
     }