From 44ab8c45d7e9070e16337d0652709358e3ae4bac Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Wed, 19 Jul 2017 17:35:57 -0700
Subject: [PATCH] Fix a crash bug in the woff2 decoder when totalSfntSize in
 the woff2 header is <= 0.

---
 src/woff2_dec.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/woff2_dec.cc b/src/woff2_dec.cc
index ee85fad..d07e2ed 100644
--- a/src/woff2_dec.cc
+++ b/src/woff2_dec.cc
@@ -1299,6 +1299,9 @@ bool ConvertWOFF2ToTTF(const uint8_t* data, size_t length,
 
   const uint8_t* src_buf = data + hdr.compressed_offset;
   std::vector<uint8_t> uncompressed_buf(hdr.uncompressed_size);
+  if (PREDICT_FALSE(hdr.uncompressed_size < 1)) {
+    return FONT_COMPRESSION_FAILURE();
+  }
   if (PREDICT_FALSE(!Woff2Uncompress(&uncompressed_buf[0],
                                      hdr.uncompressed_size, src_buf,
                                      hdr.compressed_length))) {