* src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables.

Reported by Behdad.
7 years ago · 3e4b79970e
parent d1b6c6e211
commit 3e4b79970e
2 changed files with 13 additions and 1 deletions
--- a/6
+++ b/6
@ -1,3 +1,9 @@
+2017-09-11  Werner Lemberg  <wl@gnu.org>
+
+	* src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables.
+
+	Reported by Behdad.
+
 2017-09-09  Werner Lemberg  <wl@gnu.org>

 	[autofit] Improve communication with ftgrid.
--- a/src/sfnt/ttkern.c
+++ b/src/sfnt/ttkern.c
@ -85,7 +85,7 @@

    for ( nn = 0; nn < num_tables; nn++ )
    {
-      FT_UInt    num_pairs, length, coverage;
+      FT_UInt    num_pairs, length, coverage, format;
      FT_Byte*   p_next;
      FT_UInt32  mask = (FT_UInt32)1UL << nn;

@ -107,6 +107,12 @@
      if ( p_next > p_limit )  /* handle broken table */
        p_next = p_limit;

+      format = coverage >> 8;
+
+      /* we currently only support format 0 kerning tables */
+      if ( format != 0 )
+        goto NextTable;
+
      /* only use horizontal kerning tables */
      if ( ( coverage & 3U ) != 0x0001 ||
           p + 8 > p_next              )