shithub: freetype+ttf2subf

Download patch

ref: 779309744222a736eba0f1731e8162fce6288d4e
parent: 27fee7f8c6ae75e066b5a23472b33925c6e8b1e0
author: Werner Lemberg <[email protected]>
date: Tue Mar 7 12:27:58 EST 2017 

[sfnt] Improve handling for buggy variation fonts.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=738

* src/sfnt/sfobjs.c (sfnt_init_face): While setting number of
instances to zero for `CFF' fonts table, ensure that there is no `glyf'
present also (which gets priority).

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2017-03-07  Werner Lemberg  <[email protected]>
+
+	[sfnt] Improve handling for buggy variation fonts.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=738
+
+	* src/sfnt/sfobjs.c (sfnt_init_face): While setting number of
+	instances to zero for `CFF' fonts table, ensure that there is no `glyf'
+	present also (which gets priority).
+
 2017-03-06  Werner Lemberg  <[email protected]>
 
 	[sfnt, truetype] Always provide default instance.
--- a/src/sfnt/sfobjs.c
+++ b/src/sfnt/sfobjs.c
@@ -999,10 +999,6 @@
       else
         face->variation_support |= TT_FACE_FLAG_VAR_FVAR;
 
-      /* we don't support Multiple Master CFFs yet */
-      if ( !face->goto_table( face, TTAG_CFF, stream, 0 ) )
-        num_instances = 0;
-
       /*
        *  As documented in the OpenType specification, an entry for the
        *  default instance may be omitted in the named instance table.  In
@@ -1061,6 +1057,11 @@
 
       FT_FREE( default_values );
       FT_FREE( instance_values );
+
+      /* we don't support Multiple Master CFFs yet */
+      if ( face->goto_table( face, TTAG_glyf, stream, 0 ) &&
+           !face->goto_table( face, TTAG_CFF, stream, 0 ) )
+        num_instances = 0;
 
       /* instance indices in `face_instance_index' start with index 1, */
       /* thus `>' and not `>='                                         */