For the 249 branch:...

third_party/WebKit/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp

 /*
  * Copyright (C) 2007 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  *
  */
 
 #include "config.h"
 #include "FontCustomPlatformData.h"
 
 #include <ApplicationServices/ApplicationServices.h>
 #include "SharedBuffer.h"
 #include "FontPlatformData.h"
+#include "OpenTypeSanitizer.h"
 
 namespace WebCore {
 
 FontCustomPlatformData::~FontCustomPlatformData()
 {
     if (m_atsContainer)
         ATSFontDeactivate(m_atsContainer, NULL, kATSOptionFlagsDefault);
     CGFontRelease(m_cgFont);
 }
 
 FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontRenderingMode)
 {
     return FontPlatformData(m_cgFont, (ATSUFontID)m_atsFont, size, bold, italic);
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
 {
     ASSERT_ARG(buffer, buffer);
 
+#if ENABLE(OPENTYPE_SANITIZER)
+    OpenTypeSanitizer sanitizer(buffer);
+    RefPtr<SharedBuffer> transcodeBuffer = sanitizer.sanitize();
+    if (!transcodeBuffer)
+        return 0; // validation failed.
+    buffer = transcodeBuffer.get();
+#endif
+
     ATSFontContainerRef containerRef = 0;
     ATSFontRef fontRef = 0;
 
     RetainPtr<CGFontRef> cgFontRef;
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     RetainPtr<CFDataRef> bufferData(AdoptCF, buffer->createCFData());
     RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(bufferData.get()));
     
     cgFontRef.adoptCF(CGFontCreateWithDataProvider(dataProvider.get()));
@@ skipping 30 matching lines @@
     if (!cgFontRef) {
         ATSFontDeactivate(containerRef, NULL, kATSOptionFlagsDefault);
         return 0;
     }
 #endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 
     return new FontCustomPlatformData(containerRef, fontRef, cgFontRef.releaseRef());
 }
 
 }