[OTS] Fails to Reject CID Fonts When Top Dict is Ordered Incorrectly

src/cff.cc

-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cff.h"
 
 #include <cstring>
 #include <utility>  // std::pair
 #include <vector>
 
 #include "cff_type2_charstring.h"
 
 // CFF - PostScript font program (Compact Font Format) table
-// http://www.microsoft.com/opentype/otspec/cff.htm
-// http://www.microsoft.com/opentype/otspec/5176.CFF.pdf
+// http://www.microsoft.com/typography/otspec/cff.htm
+// http://www.microsoft.com/typography/otspec/cffspec.htm
 
 namespace {
 
 enum DICT_OPERAND_TYPE {
   DICT_OPERAND_INTEGER,
   DICT_OPERAND_REAL,
   DICT_OPERATOR,
 };
 
 enum DICT_DATA_TYPE {
   DICT_DATA_TOPLEVEL,
   DICT_DATA_FDARRAY,
 };
 
+enum FONT_FORMAT {
+  FORMAT_UNKNOWN,
+  FORMAT_CID_KEYED,
+  FORMAT_OTHER,  // Including synthetic fonts
+};
+
 // see Appendix. A
 const size_t kNStdString = 390;
 
 bool ReadOffset(ots::Buffer *table, uint8_t off_size, uint32_t *offset) {
   if (off_size > 4) {
     return OTS_FAILURE();
   }
 
   uint32_t tmp32 = 0;
   for (unsigned i = 0; i < off_size; ++i) {
@@ skipping 417 matching lines @@
                    DICT_DATA_TYPE type, ots::OpenTypeCFF *out_cff) {
   for (unsigned i = 1; i < index.offsets.size(); ++i) {
     if (type == DICT_DATA_TOPLEVEL) {
       out_cff->char_strings_array.push_back(new ots::CFFIndex);
     }
     size_t dict_length = index.offsets[i] - index.offsets[i - 1];
     ots::Buffer table(data + index.offsets[i - 1], dict_length);
 
     std::vector<std::pair<uint32_t, DICT_OPERAND_TYPE> > operands;
 
+    FONT_FORMAT font_format = FORMAT_UNKNOWN;
     bool have_ros = false;
     size_t glyphs = 0;
     size_t charset_offset = 0;
 
     while (table.offset() < dict_length) {
       if (!ParseDictDataReadNext(&table, &operands)) {
         return OTS_FAILURE();
       }
       if (operands.empty()) {
         return OTS_FAILURE();
@@ skipping 38 matching lines @@
           break;
 
         // number
         case 13:  // UniqueID
         case (12U << 8) + 2:   // ItalicAngle
         case (12U << 8) + 3:   // UnderlinePosition
         case (12U << 8) + 4:   // UnderlineThickness
         case (12U << 8) + 5:   // PaintType
         case (12U << 8) + 8:   // StrokeWidth
         case (12U << 8) + 20:  // SyntheticBase
+          if (operands.size() != 1) {
+            return OTS_FAILURE();
+          }
+          break;
         case (12U << 8) + 31:  // CIDFontVersion
         case (12U << 8) + 32:  // CIDFontRevision
         case (12U << 8) + 33:  // CIDFontType
         case (12U << 8) + 34:  // CIDCount
         case (12U << 8) + 35:  // UIDBase
           if (operands.size() != 1) {
             return OTS_FAILURE();
           }
+          if (font_format != FORMAT_CID_KEYED) {
+            return OTS_FAILURE();
+          }
           break;
         case (12U << 8) + 6:   // CharstringType
           if (operands.size() != 1) {
             return OTS_FAILURE();
           }
           if(operands.back().second != DICT_OPERAND_INTEGER) {
             return OTS_FAILURE();
           }
           if (operands.back().first != 2) {
             // We only support the "Type 2 Charstring Format."
@@ skipping 230 matching lines @@
           if (!ParsePrivateDictData(data, table_length,
                                     private_offset, private_length,
                                     type, out_cff)) {
             return OTS_FAILURE();
           }
           break;
         }
 
         // ROS
         case (12U << 8) + 30:
-          if (type != DICT_DATA_TOPLEVEL) {
+          if (font_format != FORMAT_UNKNOWN) {
             return OTS_FAILURE();
           }
+          font_format = FORMAT_CID_KEYED;
           if (operands.size() != 3) {
             return OTS_FAILURE();
           }
           // check SIDs
           operands.pop_back();  // ignore the first number.
           if (!CheckSid(operands.back(), sid_max)) {
             return OTS_FAILURE();
           }
           operands.pop_back();
           if (!CheckSid(operands.back(), sid_max)) {
             return OTS_FAILURE();
           }
           if (have_ros) {
             return OTS_FAILURE();  // multiple ROS tables?
           }
           have_ros = true;
           break;
 
         default:
           return OTS_FAILURE();
       }
       operands.clear();
+
+      if (font_format == FORMAT_UNKNOWN) {
+        font_format = FORMAT_OTHER;
+      }
     }
 
     // parse "13. Charsets"
     if (charset_offset) {
       ots::Buffer table(data, table_length);
       table.set_offset(charset_offset);
       uint8_t format = 0;
       if (!table.ReadU8(&format)) {
         return OTS_FAILURE();
       }
@@ skipping 182 matching lines @@
     }
     for (size_t i = 0; i < file->cff->local_subrs_per_font.size(); ++i) {
       delete (file->cff->local_subrs_per_font)[i];
     }
     delete file->cff->local_subrs;
     delete file->cff;
   }
 }
 
 }  // namespace ots