For the 249 branch:...

third_party/WebKit/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp

Index: third_party/WebKit/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
===================================================================
--- third_party/WebKit/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp	(revision 32296)
+++ third_party/WebKit/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp	(working copy)
@@ -24,6 +24,7 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include "SharedBuffer.h"
 #include "FontPlatformData.h"
+#include "OpenTypeSanitizer.h"
 
 namespace WebCore {
 
@@ -43,6 +44,14 @@
 {
     ASSERT_ARG(buffer, buffer);
 
+#if ENABLE(OPENTYPE_SANITIZER)
+    OpenTypeSanitizer sanitizer(buffer);
+    RefPtr<SharedBuffer> transcodeBuffer = sanitizer.sanitize();
+    if (!transcodeBuffer)
+        return 0; // validation failed.
+    buffer = transcodeBuffer.get();
+#endif
+
     ATSFontContainerRef containerRef = 0;
     ATSFontRef fontRef = 0;