[pango/harfbuzz-ng] [GSUB] Protect against mismatching Extension subtable types

[Behdad Esfahbod <behdad src gnome org>]

commit cda2b36b75bd7be71d830bee78b2ab5845e90831
Author: Behdad Esfahbod <behdad behdad org>
Date:   Mon May 18 06:00:12 2009 -0400

    [GSUB] Protect against mismatching Extension subtable types
---
 pango/opentype/hb-ot-layout-gsub-private.h |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/pango/opentype/hb-ot-layout-gsub-private.h b/pango/opentype/hb-ot-layout-gsub-private.h
index da31a70..dc28df6 100644
--- a/pango/opentype/hb-ot-layout-gsub-private.h
+++ b/pango/opentype/hb-ot-layout-gsub-private.h
@@ -679,10 +679,13 @@ struct SubstLookup : Lookup {
     unsigned int type = get_type ();
 
     if (HB_UNLIKELY (type == GSUB_Extension)) {
-      /* Return lookup type of first extension subtable.
-       * The spec says all of them should have the same type.
-       * XXX check for that in sanitize() */
+      unsigned int count = get_subtable_count ();
       type = get_subtable(0).u.extension->get_type ();
+      /* The spec says all subtables should have the same type.
+       * This is specially important if one has a reverse type! */
+      for (unsigned int i = 1; i < count; i++)
+        if (get_subtable(i).u.extension->get_type () != type)
+	  return 0;
     }
 
     return type;