From d1efde9124f7bef4b0fd82e98f4702651d3095bc Mon Sep 17 00:00:00 2001
From: Rod Sheeter <rsheeter@google.com>
Date: Thu, 4 Feb 2016 08:24:36 -0800
Subject: [PATCH] Update woff2_dec.cc range checking

---
 src/woff2_dec.cc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/woff2_dec.cc b/src/woff2_dec.cc
index 85d307e..2fa291c 100644
--- a/src/woff2_dec.cc
+++ b/src/woff2_dec.cc
@@ -26,8 +26,8 @@
 #include <map>
 #include <memory>
 
-#include "./buffer.h"
 #include "./decode.h"
+#include "./buffer.h"
 #include "./port.h"
 #include "./round.h"
 #include "./store_bytes.h"
@@ -1121,7 +1121,8 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
 
       for (uint32_t j = 0; j < num_tables; j++) {
         unsigned int table_idx;
-        if (PREDICT_FALSE(!Read255UShort(&file, &table_idx))) {
+        if (PREDICT_FALSE(!Read255UShort(&file, &table_idx)) ||
+            table_idx >= tables.size()) {
           return FONT_COMPRESSION_FAILURE();
         }
         ttc_font.table_indices[j] = table_idx;