From 5582fcc2192bb73b48204eb1b972d6ea131f95e0 Mon Sep 17 00:00:00 2001 From: Matt Brubeck Date: Wed, 6 Jul 2016 08:16:37 -0700 Subject: [PATCH] Bail out gracefully on malformed kern table headers. Fixes #12081. --- components/gfx/platform/macos/font.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/components/gfx/platform/macos/font.rs b/components/gfx/platform/macos/font.rs index 4e4ae77213b3..35f6e9031037 100644 --- a/components/gfx/platform/macos/font.rs +++ b/components/gfx/platform/macos/font.rs @@ -113,11 +113,14 @@ impl FontHandle { let pair_data_start = subtable_start + FORMAT_0_HEADER_LEN; result.pair_data_range = pair_data_start..end; + if result.pair_data_range.len() != n_pairs * KERN_PAIR_LEN { + debug!("Bad data in kern header. Disable fast path."); + return None; + } + let pt_per_font_unit = self.ctfont.pt_size() as f64 / self.ctfont.units_per_em() as f64; result.px_per_font_unit = pt_to_px(pt_per_font_unit); - - debug_assert_eq!(n_pairs * KERN_PAIR_LEN, result.pair_data_range.len()); } start = end; }