[OTS] Fails to Reject CID Fonts When Top Dict is Ordered Incorrectly

src/cff.cc

Index: src/cff.cc
===================================================================
--- src/cff.cc	(revision 86)
+++ src/cff.cc	(working copy)
@@ -1,4 +1,4 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -11,8 +11,8 @@
 #include "cff_type2_charstring.h"
 
 // CFF - PostScript font program (Compact Font Format) table
-// http://www.microsoft.com/opentype/otspec/cff.htm
-// http://www.microsoft.com/opentype/otspec/5176.CFF.pdf
+// http://www.microsoft.com/typography/otspec/cff.htm
+// http://www.microsoft.com/typography/otspec/cffspec.htm
 
 namespace {
 
@@ -27,6 +27,12 @@
   DICT_DATA_FDARRAY,
 };
 
+enum FONT_FORMAT {
+  FORMAT_UNKNOWN,
+  FORMAT_CID_KEYED,
+  FORMAT_OTHER,  // Including synthetic fonts
+};
+
 // see Appendix. A
 const size_t kNStdString = 390;
 
@@ -464,6 +470,7 @@
 
     std::vector<std::pair<uint32_t, DICT_OPERAND_TYPE> > operands;
 
+    FONT_FORMAT font_format = FORMAT_UNKNOWN;
     bool have_ros = false;
     size_t glyphs = 0;
     size_t charset_offset = 0;
@@ -522,6 +529,10 @@
         case (12U << 8) + 5:   // PaintType
         case (12U << 8) + 8:   // StrokeWidth
         case (12U << 8) + 20:  // SyntheticBase
+          if (operands.size() != 1) {
+            return OTS_FAILURE();
+          }
+          break;
         case (12U << 8) + 31:  // CIDFontVersion
         case (12U << 8) + 32:  // CIDFontRevision
         case (12U << 8) + 33:  // CIDFontType
@@ -530,6 +541,9 @@
           if (operands.size() != 1) {
             return OTS_FAILURE();
           }
+          if (font_format != FORMAT_CID_KEYED) {
+            return OTS_FAILURE();
+          }
           break;
         case (12U << 8) + 6:   // CharstringType
           if (operands.size() != 1) {
@@ -780,9 +794,10 @@
 
         // ROS
         case (12U << 8) + 30:
-          if (type != DICT_DATA_TOPLEVEL) {
+          if (font_format != FORMAT_UNKNOWN) {
             return OTS_FAILURE();
           }
+          font_format = FORMAT_CID_KEYED;
           if (operands.size() != 3) {
             return OTS_FAILURE();
           }
@@ -805,6 +820,10 @@
           return OTS_FAILURE();
       }
       operands.clear();
+
+      if (font_format == FORMAT_UNKNOWN) {
+        font_format = FORMAT_OTHER;
+      }
     }
 
     // parse "13. Charsets"