[OTS] cmap ParseFormat4() should check the first segment

src/cmap.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cmap.h"
 
 #include <algorithm>
 #include <set>
 #include <utility>
 #include <vector>
@@ skipping 194 matching lines @@
   }
 
   // The last range must end at 0xffff
   if (ranges[segcount - 1].end_range != 0xffff) {
     return OTS_FAILURE();
   }
 
   // A format 4 CMAP subtable is complex. To be safe we simulate a lookup of
   // each code-point defined in the table and make sure that they are all valid
   // glyphs and that we don't access anything out-of-bounds.
-  for (unsigned i = 1; i < segcount; ++i) {
+  for (unsigned i = 0; i < segcount; ++i) {

[agl, 2012/09/04 13:30:05]

Was there a reason why we didn't check the 0-index table previously?

[Yusuke Sato, 2012/09/04 17:43:06]

I guess this is just a careless mistake...  Line 172 above uses 'for (unsigned i
= 1; i < segcount; ++i)' for a valid reason, and we (I??) somehow
copy-and-pasted it?

     for (unsigned cp = ranges[i].start_range; cp <= ranges[i].end_range; ++cp) {
       const uint16_t code_point = cp;
       if (ranges[i].id_range_offset == 0) {
         // this is explictly allowed to overflow in the spec
         const uint16_t glyph = code_point + ranges[i].id_delta;
         if (glyph >= num_glyphs) {
           return OTS_FAILURE();
         }
       } else {
         const uint16_t range_delta = code_point - ranges[i].start_range;
@@ skipping 841 matching lines @@
   out->RestoreChecksum(saved_checksum);
 
   return true;
 }
 
 void ots_cmap_free(OpenTypeFile *file) {
   delete file->cmap;
 }
 
 }  // namespace ots