For the 249 branch:...

third_party/WebKit/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp

Index: third_party/WebKit/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
===================================================================
--- third_party/WebKit/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp	(revision 32296)
+++ third_party/WebKit/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp	(working copy)
@@ -42,6 +42,7 @@
 
 #include "FontPlatformData.h"
 #include "NotImplemented.h"
+#include "OpenTypeSanitizer.h"
 #include "SharedBuffer.h"
 
 #if PLATFORM(WIN_OS)
@@ -171,6 +172,14 @@
 {
     ASSERT_ARG(buffer, buffer);
 
+#if ENABLE(OPENTYPE_SANITIZER)
+    OpenTypeSanitizer sanitizer(buffer);
+    RefPtr<SharedBuffer> transcodeBuffer = sanitizer.sanitize();
+    if (!transcodeBuffer)
+        return 0; // validation failed.
+    buffer = transcodeBuffer.get();
+#endif
+
 #if PLATFORM(WIN_OS)
     // Introduce the font to GDI. AddFontMemResourceEx should be used with care, because it will pollute the process's
     // font namespace (Windows has no API for creating an HFONT from data without exposing the font to the