Index: source/layout/ContextualSubstSubtables.cpp
===================================================================
--- source/layout/ContextualSubstSubtables.cpp	(revision 37085)
+++ source/layout/ContextualSubstSubtables.cpp	(revision 37086)
@@ -467,4 +467,10 @@
                     (const ChainSubClassRuleTable *) ((char *) chainSubClassSetTable + chainSubClassRuleTableOffset);
                 le_uint16 backtrackGlyphCount = SWAPW(chainSubClassRuleTable->backtrackGlyphCount);
+
+                // TODO: Ticket #11557 - enable this check, originally from ticket #11525.
+                //       Depends on other, more extensive, changes.
+                // LEReferenceToArrayOf<le_uint16>   backtrackClassArray(base, success, chainSubClassRuleTable->backtrackClassArray, backtrackGlyphCount);
+                if( LE_FAILURE(success) ) { return 0; }
+
                 le_uint16 inputGlyphCount = SWAPW(chainSubClassRuleTable->backtrackClassArray[backtrackGlyphCount]) - 1;
                 const le_uint16 *inputClassArray = &chainSubClassRuleTable->backtrackClassArray[backtrackGlyphCount + 1];
Index: source/layout/CursiveAttachmentSubtables.cpp
===================================================================
--- source/layout/CursiveAttachmentSubtables.cpp	(revision 37085)
+++ source/layout/CursiveAttachmentSubtables.cpp	(revision 37086)
@@ -21,5 +21,8 @@
     le_uint16 eeCount       = SWAPW(entryExitCount);
 
-    if (coverageIndex < 0 || coverageIndex >= eeCount) {
+    LEReferenceToArrayOf<EntryExitRecord>
+        entryExitRecordsArrayRef(base, success, entryExitRecords, coverageIndex);
+
+    if (coverageIndex < 0 || coverageIndex >= eeCount || LE_FAILURE(success)) {
         glyphIterator->setCursiveGlyph();
         return 0;
Index: source/layout/Features.cpp
===================================================================
--- source/layout/Features.cpp	(revision 37085)
+++ source/layout/Features.cpp	(revision 37086)
@@ -16,4 +16,7 @@
 LEReferenceTo<FeatureTable> FeatureListTable::getFeatureTable(const LETableReference &base, le_uint16 featureIndex, LETag *featureTag, LEErrorCode &success) const
 {
+    LEReferenceToArrayOf<FeatureRecord>
+        featureRecordArrayRef(base, success, featureRecordArray, featureIndex);
+
   if (featureIndex >= SWAPW(featureCount) || LE_FAILURE(success)) {
     return LEReferenceTo<FeatureTable>();
Index: source/layout/LETableReference.h
===================================================================
--- source/layout/LETableReference.h	(revision 37085)
+++ source/layout/LETableReference.h	(revision 37086)
@@ -314,5 +314,10 @@
 
   const T& getObject(le_uint32 i, LEErrorCode &success) const {
-    return *getAlias(i,success);
+      const T *ret = getAlias(i, success);
+      if (LE_FAILURE(success) || ret==NULL) {
+          return *(new T(0));
+      } else {
+          return *ret;
+     }
   }
   
Index: source/layout/LigatureSubstSubtables.cpp
===================================================================
--- source/layout/LigatureSubstSubtables.cpp	(revision 37085)
+++ source/layout/LigatureSubstSubtables.cpp	(revision 37086)
@@ -28,4 +28,7 @@
             const LigatureTable *ligTable = (const LigatureTable *) ((char *)ligSetTable + ligTableOffset);
             le_uint16 compCount = SWAPW(ligTable->compCount) - 1;
+            LEReferenceToArrayOf<TTGlyphID>
+                componentArrayRef(base, success, ligTable->componentArray, compCount);
+            if (LE_FAILURE(success)) { return 0; }
             le_int32 startPosition = glyphIterator->getCurrStreamPosition();
             TTGlyphID ligGlyph = SWAPW(ligTable->ligGlyph);
Index: source/layout/MultipleSubstSubtables.cpp
===================================================================
--- source/layout/MultipleSubstSubtables.cpp	(revision 37085)
+++ source/layout/MultipleSubstSubtables.cpp	(revision 37086)
@@ -36,5 +36,10 @@
     le_int32 coverageIndex = getGlyphCoverage(base, glyph, success);
     le_uint16 seqCount = SWAPW(sequenceCount);
+    LEReferenceToArrayOf<Offset>
+        sequenceTableOffsetArrayRef(base, success, sequenceTableOffsetArray, seqCount);
 
+    if (LE_FAILURE(success)) {
+        return 0;
+    }
     if (coverageIndex >= 0 && coverageIndex < seqCount) {
         Offset sequenceTableOffset = SWAPW(sequenceTableOffsetArray[coverageIndex]);