Update woff2 to a15a8ab

third_party/woff2/src/woff2_dec.cc

 // Copyright 2014 Google Inc. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 // http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 52 matching lines @@
 
 const size_t kCheckSumAdjustmentOffset = 8;
 
 const size_t kEndPtsOfContoursOffset = 10;
 const size_t kCompositeGlyphBegin = 10;
 
 // 98% of Google Fonts have no glyph above 5k bytes
 // Largest glyph ever observed was 72k bytes
 const size_t kDefaultGlyphBuf = 5120;
 
+// Over 14k test fonts the max compression ratio seen to date was ~20.
+// >100 suggests you wrote a bad uncompressed size.
+const float kMaxPlausibleCompressionRatio = 100.0;
+
 // metadata for a TTC font entry
 struct TtcFont {
   uint32_t flavor;
   uint32_t dst_offset;
   uint32_t header_checksum;
   std::vector<uint16_t> table_indices;
 };
 
 struct WOFF2Header {
   uint32_t flavor;
@@ skipping 388 matching lines @@
       if (PREDICT_FALSE(!SizeOfComposite(composite_stream, &composite_size,
                                          &have_instructions))) {
         return FONT_COMPRESSION_FAILURE();
       }
       if (have_instructions) {
         if (PREDICT_FALSE(!Read255UShort(&glyph_stream, &instruction_size))) {
           return FONT_COMPRESSION_FAILURE();
         }
       }
 
-      size_t size_needed = 2 + composite_size + instruction_size;
+      size_t size_needed = 12 + composite_size + instruction_size;
       if (PREDICT_FALSE(glyph_buf_size < size_needed)) {
         glyph_buf.reset(new uint8_t[size_needed]);
         glyph_buf_size = size_needed;
       }
 
       glyph_size = Store16(glyph_buf.get(), glyph_size, n_contours);
       if (PREDICT_FALSE(!bbox_stream.Read(glyph_buf.get() + glyph_size, 8))) {
         return FONT_COMPRESSION_FAILURE();
       }
       glyph_size += 8;
@@ skipping 173 matching lines @@
   bool has_proportional_lsbs = (hmtx_flags & 1) == 0;
   bool has_monospace_lsbs = (hmtx_flags & 2) == 0;
 
   // you say you transformed but there is little evidence of it
   if (has_proportional_lsbs && has_monospace_lsbs) {
     return FONT_COMPRESSION_FAILURE();
   }
 
   assert(x_mins.size() == num_glyphs);
 
+  // num_glyphs 0 is OK if there is no 'glyf' but cannot then xform 'hmtx'.
+  if (PREDICT_FALSE(num_hmetrics > num_glyphs)) {
+    return FONT_COMPRESSION_FAILURE();
+  }
+
   for (uint16_t i = 0; i < num_hmetrics; i++) {
     uint16_t advance_width;
     if (PREDICT_FALSE(!hmtx_buff_in.ReadU16(&advance_width))) {
       return FONT_COMPRESSION_FAILURE();
     }
     advance_widths.push_back(advance_width);
   }
 
   for (uint16_t i = 0; i < num_hmetrics; i++) {
     int16_t lsb;
@@ skipping 578 matching lines @@
   RebuildMetadata metadata;
   WOFF2Header hdr;
   if (!ReadWOFF2Header(data, length, &hdr)) {
     return FONT_COMPRESSION_FAILURE();
   }
 
   if (!WriteHeaders(data, length, &metadata, &hdr, out)) {
     return FONT_COMPRESSION_FAILURE();
   }
 
+  const float compression_ratio = (float) hdr.uncompressed_size / length;
+  if (compression_ratio > kMaxPlausibleCompressionRatio) {
+#ifdef FONT_COMPRESSION_BIN
+    fprintf(stderr, "Implausible compression ratio %.01f\n", compression_ratio);
+#endif
+    return FONT_COMPRESSION_FAILURE();
+  }
+
   const uint8_t* src_buf = data + hdr.compressed_offset;
   std::vector<uint8_t> uncompressed_buf(hdr.uncompressed_size);
   if (PREDICT_FALSE(!Woff2Uncompress(&uncompressed_buf[0],
                                      hdr.uncompressed_size, src_buf,
                                      hdr.compressed_length))) {
     return FONT_COMPRESSION_FAILURE();
   }
 
   for (size_t i = 0; i < metadata.font_infos.size(); i++) {
     if (PREDICT_FALSE(!ReconstructFont(&uncompressed_buf[0],
                                        hdr.uncompressed_size,
                                        &metadata, &hdr, i, out))) {
       return FONT_COMPRESSION_FAILURE();
     }
   }
 
   return true;
 }
 
 } // namespace woff2