[freetype2] master 8a9192f68: [sfnt] Check safety of cast to `TT_Driver` before accessing member.

[Werner Lemberg]

branch: master
commit 8a9192f68ef0100649502bd8fe17df7f51211521
Author: Dominik Röttsches <drott@chromium.org>
Commit: Werner Lemberg <wl@gnu.org>

    [sfnt] Check safety of cast to `TT_Driver` before accessing member.
    
    * src/sfnt/ttcolr.c (VARIABLE_COLRV1_ENABLED): Access
    `enable_variable_colrv1` only if driver class matches.
---
 src/sfnt/ttcolr.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c
index c7232e1fc..e624c1353 100644
--- a/src/sfnt/ttcolr.c
+++ b/src/sfnt/ttcolr.c
@@ -35,9 +35,11 @@
 #include <freetype/ftcolor.h>
 #include <freetype/config/integer-types.h>
 
- /* the next code line is a temporary hack, to be removed together with */
- /* `VARIABLE_COLRV1_ENABLED` and related code                          */
+ /* the next two code lines are a temporary hack, to be removed together */
+ /* with `VARIABLE_COLRV1_ENABLED` and related code as soon as variable  */
+ /* 'COLR' support is complete and tested                                */
 #include "../truetype/ttobjs.h"
+#include "../truetype/ttdriver.h"
 
 
 #ifdef TT_CONFIG_OPTION_COLOR_LAYERS
@@ -55,8 +57,10 @@
 #define COLR_HEADER_SIZE                 14U
 
 
-#define VARIABLE_COLRV1_ENABLED                                           \
-          ( ((TT_Driver)FT_FACE_DRIVER( face ))->enable_variable_colrv1 )
+#define VARIABLE_COLRV1_ENABLED                                            \
+          ( ((TT_Driver)FT_FACE_DRIVER( face ))->root.clazz ==             \
+              &tt_driver_class                                          && \
+            ((TT_Driver)FT_FACE_DRIVER( face ))->enable_variable_colrv1 )
 
 
   typedef enum  FT_PaintFormat_Internal_