From 0634e0a7194d23a0855da78bf950ce2cd7366ea4 Mon Sep 17 00:00:00 2001
From: Khaled Hosny <khaledhosny@eglug.org>
Date: Sun, 1 Feb 2015 09:22:50 +0200
Subject: [PATCH] Don't accept too long totalSfntSize

Per the spec (WOFF 2.0 spec just refer to WOFF 1.0 spec here):
http://www.w3.org/TR/2012/REC-WOFF-20121213/#conform-totalsize-longword-reject
---
 src/woff2_dec.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/woff2_dec.cc b/src/woff2_dec.cc
index e202672..0e38ea8 100644
--- a/src/woff2_dec.cc
+++ b/src/woff2_dec.cc
@@ -807,7 +807,7 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
   }
   // We don't care about these fields of the header:
   //   uint16_t reserved
-  //   uint32_t total_sfnt_size
+  //   uint32_t total_sfnt_size, the caller already passes it as result_length
   if (!file.Skip(6)) {
     return FONT_COMPRESSION_FAILURE();
   }
@@ -926,7 +926,7 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
   if (uncompressed_sum > 30 * 1024 * 1024) {
     return FONT_COMPRESSION_FAILURE();
   }
-  if (src_offset > length || dst_offset > result_length) {
+  if (src_offset > length || dst_offset != result_length) {
     fprintf(stderr, "offset fail; src_offset %lu length %lu "
       "dst_offset %lu result_length %lu\n",
       src_offset, length, dst_offset, result_length);