[COLR] Sanitize BaseGlyphRecord (#854)

src/hb-ot-colr-table.hh

@@ -42,10 +42,10 @@ struct LayerRecord
   inline bool sanitize (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
-    return_trace (true);
+    return_trace (c->check_struct (this));
   }
 
-  HBUINT16 gID;			/* Glyph ID of layer glyph */
+  GlyphID gID;			/* Glyph ID of layer glyph */
   HBUINT16 paletteIndex;	/* Index value to use with a selected color palette */
   public:
   DEFINE_SIZE_STATIC (4);
@@ -53,13 +53,15 @@ struct LayerRecord
 
 struct BaseGlyphRecord
 {
-  inline bool sanitize (hb_sanitize_context_t *c, unsigned int palettes) const
+  inline bool sanitize (hb_sanitize_context_t *c, const void *base) const
   {
     TRACE_SANITIZE (this);
-    return_trace (c->check_struct (this));
+    return_trace (c->check_struct (this) &&
+      firstLayerIndex.sanitize (c, base) &&
+      c->check_array ((const void*) &firstLayerIndex, sizeof (LayerRecord), numLayers));
   }
 
-  HBUINT16 gID;			/* Glyph ID of reference glyph */
+  GlyphID gID;			/* Glyph ID of reference glyph */
   OffsetTo<LayerRecord>
   	firstLayerIndex;	/* Index to the layer record */
   HBUINT16 numLayers;		/* Number of color layers associated with this glyph */
@@ -74,9 +76,17 @@ struct COLR
   inline bool sanitize (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
-    return_trace (c->check_struct (this) &&
-        c->check_array ((const void*) &baseGlyphRecords, sizeof (BaseGlyphRecord), numBaseGlyphRecords) &&
-        c->check_array ((const void*) &layerRecordsOffset, sizeof (LayerRecord), numLayerRecords));
+    if (!(c->check_struct (this) &&
+      c->check_array ((const void*) &baseGlyphRecords, sizeof (BaseGlyphRecord), numBaseGlyphRecords) &&
+      c->check_array ((const void*) &layerRecordsOffset, sizeof (LayerRecord), numLayerRecords)))
+      return_trace (false);
+
+    const BaseGlyphRecord *base_glyph_records = &baseGlyphRecords (this);
+    for (unsigned int i = 0; i < numBaseGlyphRecords; ++i)
+      if (!(base_glyph_records[i].sanitize (c, this)))
+        return_trace (false);
+
+    return_trace (true);
   }
 
   protected:
@@ -87,7 +97,6 @@ struct COLR
   LOffsetTo<LayerRecord>
 		layerRecordsOffset;	/* Offset to Layer Records */
   HBUINT16	numLayerRecords;	/* Number of Layer Records */
-
   public:
   DEFINE_SIZE_STATIC (14);
 };