[kerx] Use subtable range for runtime checks

src/hb-aat-layout-kerx-table.hh

@@ -124,7 +124,7 @@ struct KerxSubTableFormat2
     TRACE_APPLY (this);
 
     accelerator_t accel (*this,
-			 c->sanitizer.end, /* XXX Use SubTable length? */
+			 c->sanitizer.end,
 			 c->face->get_num_glyphs ());
     hb_kern_machine_t<accelerator_t> machine (accel);
     machine.kern (c->font, c->buffer, c->plan->kern_mask);
@@ -328,6 +328,8 @@ struct kerx
       if (reverse)
         c->buffer->reverse ();
 
+      c->sanitizer.set_object (*table);
+
       /* XXX Reverse-kern is not working yet...
        * hb_kern_machine_t would need to know that it's reverse-kerning.
        * Or better yet, make it work in reverse as well, so we don't have

src/hb-machinery.hh

@@ -254,6 +254,14 @@ struct hb_sanitize_context_t :
 
   inline void set_max_ops (unsigned int max_ops_) { max_ops = max_ops_; }
 
+  template <typename T>
+  inline void set_object (const T& obj)
+  {
+    this->start = (const char *) &obj;
+    this->end = (const char *) &obj + obj.get_size ();
+    assert (this->start <= this->end); /* Must not overflow. */
+  }
+
   inline void start_processing (void)
   {
     this->start = this->blob->data;