From 63626fb251ce5d89650d28bc5d6ccd7d63a70fef Mon Sep 17 00:00:00 2001 From: Denys Smirnov Date: Thu, 25 Oct 2018 03:51:34 +0300 Subject: [PATCH] font/sfnt: fix hmtx table size validation The library assumes the hmtx size to be equal to 2*nGlyph + 2*nHm, which is a simplification of 4*nHm + 2*(nGlyph-nHm) as described in the spec. However, fonts seen in the wild sometimes omit the second term (left side bearings), making validation to fail. CL fixes the validation code by allowing to omit the second term. Fixes golang/go#28379 Change-Id: I2293e498e72f95e5fe08c2b375ea7b020d06cde3 Reviewed-on: https://go-review.googlesource.com/c/144080 Reviewed-by: Nigel Tao --- font/sfnt/sfnt.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/font/sfnt/sfnt.go b/font/sfnt/sfnt.go index eaae675..7a8effd 100644 --- a/font/sfnt/sfnt.go +++ b/font/sfnt/sfnt.go @@ -904,7 +904,10 @@ func (f *Font) parseHhea(buf []byte, numGlyphs int32) (buf1 []byte, ascent, desc func (f *Font) parseHmtx(buf []byte, numGlyphs, numHMetrics int32) (buf1 []byte, err error) { // https://www.microsoft.com/typography/OTSPEC/hmtx.htm - if f.hmtx.length != uint32(2*numGlyphs+2*numHMetrics) { + // The spec says that the hmtx table's length should be + // "4*numHMetrics+2*(numGlyphs-numHMetrics)". However, some fonts seen in the + // wild omit the "2*(nG-nHM)". See https://github.com/golang/go/issues/28379 + if f.hmtx.length != uint32(4*numHMetrics) && f.hmtx.length != uint32(4*numHMetrics+2*(numGlyphs-numHMetrics)) { return nil, errInvalidHmtxTable } return buf, nil