[OTS] Fix "continue-stream" handling in the woff2 decoder

src/woff2.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This is the implementation of decompression of the proposed WOFF Ultra
 // Condensed file format.
 
 #include <cassert>
 #include <cstdlib>
 #include <vector>
@@ skipping 808 matching lines @@
     if ((flags & kWoff2FlagsTransform) != 0) {
       if (!ReadBase128(file, &transform_length)) {
         return OTS_FAILURE();
       }
     }
     uint32_t src_length = transform_length;
     if ((flag_byte >> 6) == 1 || (flag_byte >> 6) == 2) {
       if (!ReadBase128(file, &src_length)) {
         return OTS_FAILURE();
       }
+    } else if ((flag_byte >> 6) == kShortFlagsContinue) {
+      // The compressed data for this table is in a previuos table, so we set
+      // the src_length to zero.
+      src_length = 0;
     }
     // Disallow huge numbers (> 1GB) for sanity.
     if (src_length > 1024 * 1024 * 1024 ||
         transform_length > 1024 * 1024 * 1024 ||
         dst_length > 1024 * 1024 * 1024) {
       return OTS_FAILURE();
     }
 
     table->tag = tag;
     table->flags = flags;
@@ skipping 108 matching lines @@
   offset = Store16(result, offset, (num_tables << 4) - output_search_range);
   for (uint16_t i = 0; i < num_tables; ++i) {
     const Table* table = &tables.at(i);
     offset = StoreU32(result, offset, table->tag);
     offset = StoreU32(result, offset, 0);  // checksum, to fill in later
     offset = StoreU32(result, offset, table->dst_offset);
     offset = StoreU32(result, offset, table->dst_length);
   }
   std::vector<uint8_t> uncompressed_buf;
   bool continue_valid = false;
+  const uint8_t* transform_buf = NULL;
   for (uint16_t i = 0; i < num_tables; ++i) {
     const Table* table = &tables.at(i);
     uint32_t flags = table->flags;
     const uint8_t* src_buf = data + table->src_offset;
     uint32_t compression_type = flags & kCompressionTypeMask;
-    const uint8_t* transform_buf = NULL;
     size_t transform_length = table->transform_length;
     if ((flags & kWoff2FlagsContinueStream) != 0) {
       if (!continue_valid) {
         return OTS_FAILURE();
       }
     } else if (compression_type == kCompressionTypeNone) {
       if (transform_length != table->src_length) {
         return OTS_FAILURE();
       }
       transform_buf = src_buf;
@@ skipping 45 matching lines @@
       if (transform_buf > &uncompressed_buf[0] + uncompressed_buf.size()) {
         return OTS_FAILURE();
       }
     }
   }
 
   return FixChecksums(tables, result);
 }
 
 }  // namespace ots