Merge pull request mozilla#2385 from yurydelendik/issue-2374

Rejects post table if maxp numGlyph does not match
darshilSoni · Nov 16, 2012 · 9910699 · 9910699
2 parents ae62170 + 0646d39
commit 9910699
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/src/fonts.js b/src/fonts.js
@@ -3181,7 +3181,7 @@ var Font = (function FontClosure() {
         }
       }
 
-      function readPostScriptTable(post, properties) {
+      function readPostScriptTable(post, properties, maxpNumGlyphs) {
         var start = (font.start ? font.start : 0) + post.offset;
         font.pos = start;
 
@@ -3198,6 +3198,10 @@ var Font = (function FontClosure() {
             break;
           case 0x00020000:
             var numGlyphs = int16(font.getBytes(2));
+            if (numGlyphs != maxpNumGlyphs) {
+              valid = false;
+              break;
+            }
             var glyphNameIndexes = [];
             for (var i = 0; i < numGlyphs; ++i) {
               var index = int16(font.getBytes(2));
@@ -3532,7 +3536,7 @@ var Font = (function FontClosure() {
 
       // The 'post' table has glyphs names.
       if (post) {
-        var valid = readPostScriptTable(post, properties);
+        var valid = readPostScriptTable(post, properties, numGlyphs);
         if (!valid) {
           tables.splice(tables.indexOf(post), 1);
           post = null;