From 3e4b79970e0681bd2481392420a0eb4dc7820b70 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Mon, 11 Sep 2017 08:51:44 +0200 Subject: [PATCH] * src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables. Reported by Behdad. --- ChangeLog | 6 ++++++ src/sfnt/ttkern.c | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index d6ba1c897..cc30bad58 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2017-09-11 Werner Lemberg + + * src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables. + + Reported by Behdad. + 2017-09-09 Werner Lemberg [autofit] Improve communication with ftgrid. diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c index c97e5789a..53d2436ae 100644 --- a/src/sfnt/ttkern.c +++ b/src/sfnt/ttkern.c @@ -85,7 +85,7 @@ for ( nn = 0; nn < num_tables; nn++ ) { - FT_UInt num_pairs, length, coverage; + FT_UInt num_pairs, length, coverage, format; FT_Byte* p_next; FT_UInt32 mask = (FT_UInt32)1UL << nn; @@ -107,6 +107,12 @@ if ( p_next > p_limit ) /* handle broken table */ p_next = p_limit; + format = coverage >> 8; + + /* we currently only support format 0 kerning tables */ + if ( format != 0 ) + goto NextTable; + /* only use horizontal kerning tables */ if ( ( coverage & 3U ) != 0x0001 || p + 8 > p_next )