From 679771f97abde325d3c96a2d46f71ffc2942a121 Mon Sep 17 00:00:00 2001
From: Rod Sheeter <rsheeter@google.com>
Date: Wed, 23 Aug 2017 13:58:32 -0700
Subject: [PATCH] Reject fonts with bounding boxes for empty glyphs

---
 src/woff2_dec.cc | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/woff2_dec.cc b/src/woff2_dec.cc
index b7c70df..831dd45 100644
--- a/src/woff2_dec.cc
+++ b/src/woff2_dec.cc
@@ -600,6 +600,14 @@ bool ReconstructGlyf(const uint8_t* data, Table* glyf_table,
             instruction_size, glyph_buf.get(), glyph_buf_size, &glyph_size))) {
         return FONT_COMPRESSION_FAILURE();
       }
+    } else {
+      // n_contours == 0; empty glyph. Must NOT have a bbox.
+      if (PREDICT_FALSE(have_bbox)) {
+#ifdef FONT_COMPRESSION_BIN
+        fprintf(stderr, "Empty glyph has a bbox\n");
+#endif
+        return FONT_COMPRESSION_FAILURE();
+      }
     }
 
     loca_values[i] = out->Size() - glyf_start;