Update woff2 to cbea7b9

third_party/woff2/src/woff2_dec.cc

Index: third_party/woff2/src/woff2_dec.cc
diff --git a/third_party/woff2/src/woff2_dec.cc b/third_party/woff2/src/woff2_dec.cc
index 6f26a305ffdab453e7dfe017f4957edb9d9e427d..ee85fad72bfd36c65d6e629f8f232a7590b74b85 100644
--- a/third_party/woff2/src/woff2_dec.cc
+++ b/third_party/woff2/src/woff2_dec.cc
@@ -18,7 +18,6 @@
 
 #include <stdlib.h>
 #include <algorithm>
-#include <brotli/decode.h>
 #include <complex>
 #include <cstring>
 #include <limits>
@@ -28,6 +27,7 @@
 #include <memory>
 #include <utility>
 
+#include "./brotli/decode.h"
 #include "./buffer.h"
 #include "./port.h"
 #include "./round.h"
@@ -681,6 +681,12 @@ bool ReconstructTransformedHmtx(const uint8_t* transformed_buf,
     return FONT_COMPRESSION_FAILURE();
   }
 
+  // https://www.microsoft.com/typography/otspec/hmtx.htm
+  // "...only one entry need be in the array, but that entry is required."
+  if (PREDICT_FALSE(num_hmetrics < 1)) {
+    return FONT_COMPRESSION_FAILURE();
+  }
+
   for (uint16_t i = 0; i < num_hmetrics; i++) {
     uint16_t advance_width;
     if (PREDICT_FALSE(!hmtx_buff_in.ReadU16(&advance_width))) {
@@ -739,7 +745,7 @@ bool Woff2Uncompress(uint8_t* dst_buf, size_t dst_size,
   BrotliDecoderResult result = BrotliDecoderDecompress(
       src_size, src_buf, &uncompressed_size, dst_buf);
   if (PREDICT_FALSE(result != BROTLI_DECODER_RESULT_SUCCESS ||
-      uncompressed_size != dst_size)) {
+                    uncompressed_size != dst_size)) {
     return FONT_COMPRESSION_FAILURE();
   }
   return true;
@@ -918,7 +924,10 @@ bool ReconstructFont(uint8_t* transformed_buf,
         table.dst_offset = dest_offset;
         checksum = ComputeULongSum(transformed_buf + table.src_offset,
                                    table.src_length);
-        out->Write(transformed_buf + table.src_offset, table.src_length);
+        if (PREDICT_FALSE(!out->Write(transformed_buf + table.src_offset,
+            table.src_length))) {
+          return FONT_COMPRESSION_FAILURE();
+        }
       } else {
         if (table.tag == kGlyfTableTag) {
           table.dst_offset = dest_offset;