[ot-font] Fix hmtx wrong table length check

Discovered by libFuzzer. Ouch! #139 (comment)
harfbuzz · Oct 15, 2015 · 63ef0b4 · 63ef0b4
1 parent 613e630
commit 63ef0b4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/hb-ot-font.cc b/src/hb-ot-font.cc
@@ -59,7 +59,7 @@ struct hb_ot_face_metrics_accelerator_t
 
     this->blob = OT::Sanitizer<OT::_mtx>::sanitize (face->reference_table (_mtx_tag));
     if (unlikely (!this->num_advances ||
-		  2 * (this->num_advances + this->num_metrics) < hb_blob_get_length (this->blob)))
+		  2 * (this->num_advances + this->num_metrics) > hb_blob_get_length (this->blob)))
     {
       this->num_metrics = this->num_advances = 0;
       hb_blob_destroy (this->blob);