[OTS] Allow empty Private DICT inside CFF data

src/cff.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cff.h"
 
 #include <cstring>
 #include <utility>  // std::pair
 #include <vector>
 
@@ skipping 742 matching lines @@
           }
           if (operands.back().second != DICT_OPERAND_INTEGER) {
             return OTS_FAILURE();
           }
           const uint32_t private_offset = operands.back().first;
           operands.pop_back();
           if (operands.back().second != DICT_OPERAND_INTEGER) {
             return OTS_FAILURE();
           }
           const uint32_t private_length = operands.back().first;
-          if (private_offset >= table_length) {
+          if (private_offset > table_length) {
             return OTS_FAILURE();
           }
           if (private_length >= table_length) {
             return OTS_FAILURE();
           }
           if (private_length + private_offset > table_length) {
             // does not overflow since table_length < 1GB

[agl, 2012/02/23 15:30:55]

Note: this comment is nonsensical. It doesn't matter what value table_length
has, in order to avoid overflow, |private_length| and |private_offset| have to
be correctly bounded.

[bashi, 2012/02/23 23:36:34]

Done.

             return OTS_FAILURE();
           }
           // parse "15. Private DICT Data"
           if (!ParsePrivateDictData(data, table_length,
                                     private_offset, private_length,
                                     type, out_cff)) {
             return OTS_FAILURE();
           }
           break;
         }
@@ skipping 220 matching lines @@
     }
     for (size_t i = 0; i < file->cff->local_subrs_per_font.size(); ++i) {
       delete (file->cff->local_subrs_per_font)[i];
     }
     delete file->cff->local_subrs;
     delete file->cff;
   }
 }
 
 }  // namespace ots