From f074da8c2b6a7061c71d12213a6c494c119eb20e Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Sat, 3 Nov 2018 15:06:45 -0400
Subject: [PATCH] [kern] Really fix access violation in Format3

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11245
---
 src/hb-ot-kern-table.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/hb-ot-kern-table.hh b/src/hb-ot-kern-table.hh
index 28ea9526d..b0ed4399b 100644
--- a/src/hb-ot-kern-table.hh
+++ b/src/hb-ot-kern-table.hh
@@ -444,7 +444,7 @@ struct KernSubTableFormat3
     return_trace (true); /* Disabled.  See above. */
     return_trace (c->check_struct (this) &&
 		  c->check_range (kernValueZ,
-				  kernValueCount +
+				  kernValueCount * sizeof (FWORD) +
 				  glyphCount * 2 +
 				  leftClassCount * rightClassCount));
   }