diff --git a/src/woff2_dec.cc b/src/woff2_dec.cc
index d07e2ed..0986cfd 100644
--- a/src/woff2_dec.cc
+++ b/src/woff2_dec.cc
@@ -876,11 +876,26 @@ bool ReconstructFont(uint8_t* transformed_buf,
std::vector
tables = Tables(hdr, font_index);
// 'glyf' without 'loca' doesn't make sense
- if (PREDICT_FALSE(static_cast(FindTable(&tables, kGlyfTableTag)) !=
- static_cast(FindTable(&tables, kLocaTableTag)))) {
+ const Table* glyf_table = FindTable(&tables, kGlyfTableTag);
+ const Table* loca_table = FindTable(&tables, kLocaTableTag);
+ if (PREDICT_FALSE(static_cast(glyf_table) !=
+ static_cast(loca_table))) {
+#ifdef FONT_COMPRESSION_BIN
+ fprintf(stderr, "Cannot have just one of glyf/loca\n");
+#endif
return FONT_COMPRESSION_FAILURE();
}
+ if (glyf_table != NULL) {
+ if (PREDICT_FALSE((glyf_table->flags & kWoff2FlagsTransform)
+ != (loca_table->flags & kWoff2FlagsTransform))) {
+#ifdef FONT_COMPRESSION_BIN
+ fprintf(stderr, "Cannot transform just one of glyf/loca\n");
+#endif
+ return FONT_COMPRESSION_FAILURE();
+ }
+ }
+
uint32_t font_checksum = metadata->header_checksum;
if (hdr->header_version) {
font_checksum = hdr->ttc_fonts[font_index].header_checksum;
@@ -1100,8 +1115,9 @@ bool ReadWOFF2Header(const uint8_t* data, size_t length, WOFF2Header* hdr) {
ttc_font.table_indices.resize(num_tables);
- const Table* glyf_table = NULL;
- const Table* loca_table = NULL;
+
+ unsigned int glyf_idx = 0;
+ unsigned int loca_idx = 0;
for (uint32_t j = 0; j < num_tables; j++) {
unsigned int table_idx;
@@ -1113,19 +1129,23 @@ bool ReadWOFF2Header(const uint8_t* data, size_t length, WOFF2Header* hdr) {
const Table& table = hdr->tables[table_idx];
if (table.tag == kLocaTableTag) {
- loca_table = &table;
+ loca_idx = table_idx;
}
if (table.tag == kGlyfTableTag) {
- glyf_table = &table;
+ glyf_idx = table_idx;
}
}
- if (PREDICT_FALSE((glyf_table == NULL) != (loca_table == NULL))) {
+ // if we have both glyf and loca make sure they are consecutive
+ // if we have just one we'll reject the font elsewhere
+ if (glyf_idx > 0 || loca_idx > 0) {
+ if (PREDICT_FALSE(glyf_idx > loca_idx || loca_idx - glyf_idx != 1)) {
#ifdef FONT_COMPRESSION_BIN
- fprintf(stderr, "Cannot have just one of glyf/loca\n");
+ fprintf(stderr, "TTC font %d has non-consecutive glyf/loca\n", i);
#endif
- return FONT_COMPRESSION_FAILURE();
+ return FONT_COMPRESSION_FAILURE();
+ }
}
}
}
diff --git a/src/woff2_decompress.cc b/src/woff2_decompress.cc
index f29c797..a3422bf 100644
--- a/src/woff2_decompress.cc
+++ b/src/woff2_decompress.cc
@@ -32,6 +32,7 @@ int main(int argc, char **argv) {
string filename(argv[1]);
string outfilename = filename.substr(0, filename.find_last_of(".")) + ".ttf";
+ // Note: update woff2_dec_fuzzer_new_entry.cc if this pattern changes.
string input = woff2::GetFileContent(filename);
const uint8_t* raw_input = reinterpret_cast(input.data());
string output(std::min(woff2::ComputeWOFF2FinalSize(raw_input, input.size()),