From 677800fa548432ab9bcb022a6f7fd9ebc7781df4 Mon Sep 17 00:00:00 2001
From: Rod Sheeter <rsheeter@google.com>
Date: Fri, 13 Oct 2017 13:12:55 -0700
Subject: [PATCH] Fix woff2_compress fuzzer bugs

---
 src/font.cc      | 3 +++
 src/normalize.cc | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/font.cc b/src/font.cc
index 6b72f6d..a45153e 100644
--- a/src/font.cc
+++ b/src/font.cc
@@ -123,6 +123,9 @@ bool ReadCollectionFont(Buffer* file, const uint8_t* data, size_t len,
       (*all_tables)[table.offset] = font->FindTable(table.tag);
     } else {
       table.reuse_of = (*all_tables)[table.offset];
+      if (table.tag != table.reuse_of->tag) {
+        return FONT_COMPRESSION_FAILURE();
+      }
     }
 
   }
diff --git a/src/normalize.cc b/src/normalize.cc
index 39f9405..6685e08 100644
--- a/src/normalize.cc
+++ b/src/normalize.cc
@@ -96,7 +96,10 @@ bool MakeEditableBuffer(Font* font, int tableTag) {
   int sz = Round4(table->length);
   table->buffer.resize(sz);
   uint8_t* buf = &table->buffer[0];
-  memcpy(buf, table->data, sz);
+  memcpy(buf, table->data, table->length);
+  if (PREDICT_FALSE(sz > table->length)) {
+    memset(buf + table->length, 0, sz - table->length);
+  }
   table->data = buf;
   return true;
 }