Update OTS to revision 99a3b7f

third_party/ots/src/cff.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cff.h"
 
 #include <cstring>
 #include <utility>
 #include <vector>
 
@@ skipping 357 matching lines @@
     }
     if (operands.back().second != DICT_OPERATOR) {
       continue;
     }
 
     // got operator
     const uint32_t op = operands.back().first;
     operands.pop_back();
 
     switch (op) {
-      // array
+      // hints
       case 6:  // BlueValues
       case 7:  // OtherBlues
       case 8:  // FamilyBlues
       case 9:  // FamilyOtherBlues
+        if (operands.empty() || (operands.size() % 2) != 0) {
+          return OTS_FAILURE();
+        }
+        break;
+
+      // array
       case (12U << 8) + 12:  // StemSnapH (delta)
       case (12U << 8) + 13:  // StemSnapV (delta)
         if (operands.empty()) {
           return OTS_FAILURE();
         }
         break;
 
       // number
       case 10:  // StdHW
       case 11:  // StdVW
@@ skipping 644 matching lines @@
       delete (font->cff->local_subrs_per_font)[i];
     }
     delete font->cff->local_subrs;
     delete font->cff;
   }
 }
 
 }  // namespace ots
 
 #undef TABLE_NAME