[GSUB] Fix context_length handling in Ligature too

src/hb-ot-layout-gsub-private.h

@@ -318,14 +318,13 @@ struct Ligature {
 
     unsigned int i, j;
     unsigned int count = component.len;
-
-    if (HB_UNLIKELY (buffer->in_pos + count > buffer->in_length ||
-		     context_length < count))
-      return false; /* Not enough glyphs in input or context */
+    unsigned int end = MIN (buffer->in_length, buffer->in_pos + context_length);
+    if (HB_UNLIKELY (buffer->in_pos + count > end))
+      return false;
 
     for (i = 1, j = buffer->in_pos + 1; i < count; i++, j++) {
       while (!_hb_ot_layout_check_glyph_property (layout, IN_ITEM (j), lookup_flag, &property)) {
-	if (HB_UNLIKELY (j + count - i == buffer->in_length))
+	if (HB_UNLIKELY (j + count - i == end))
 	  return false;
 	j++;
       }

src/hb-ot-layout-gsubgpos-private.h

@@ -221,7 +221,7 @@ static inline bool context_lookup (LOOKUP_ARGS_DEF,
 {
   /* First guess */
   if (HB_UNLIKELY (buffer->in_pos + inputCount > buffer->in_length ||
-		   context_length < inputCount))
+		   inputCount > context_length))
     return false;
 
   return match_input (LOOKUP_ARGS,
@@ -435,7 +435,8 @@ static inline bool chain_context_lookup (LOOKUP_ARGS_DEF,
 {
   /* First guess */
   if (HB_UNLIKELY (buffer->out_pos < backtrackCount ||
-		   buffer->in_pos + inputCount + lookaheadCount > buffer->in_length))
+		   buffer->in_pos + inputCount + lookaheadCount > buffer->in_length ||
+		   inputCount + lookaheadCount > context_length))
     return false;
 
   unsigned int offset;