From 531adab1fe13dc0f45d33c3dca308f84ffc7e7c9 Mon Sep 17 00:00:00 2001
From: Khaled Hosny <khaledhosny@eglug.org>
Date: Mon, 20 Apr 2015 00:21:05 +0200
Subject: [PATCH] Reject non-zero loca transformLength

---
 src/woff2_dec.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/woff2_dec.cc b/src/woff2_dec.cc
index 36f1b05..7740a5d 100644
--- a/src/woff2_dec.cc
+++ b/src/woff2_dec.cc
@@ -720,6 +720,9 @@ bool ReadTableDirectory(Buffer* file, std::vector<Table>* tables,
       if (!ReadBase128(file, &transform_length)) {
         return FONT_COMPRESSION_FAILURE();
       }
+      if (tag == kLocaTableTag && transform_length) {
+        return FONT_COMPRESSION_FAILURE();
+      }
     }
     table->tag = tag;
     table->flags = flags;