[freetype2] master 3e4b799: * src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables.

[Werner LEMBERG]

branch: master
commit 3e4b79970e0681bd2481392420a0eb4dc7820b70
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables.
    
    Reported by Behdad.
---
 ChangeLog         | 6 ++++++
 src/sfnt/ttkern.c | 8 +++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index d6ba1c8..cc30bad 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-09-11  Werner Lemberg  <address@hidden>
+
+       * src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables.
+
+       Reported by Behdad.
+
 2017-09-09  Werner Lemberg  <address@hidden>
 
        [autofit] Improve communication with ftgrid.
diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c
index c97e578..53d2436 100644
--- a/src/sfnt/ttkern.c
+++ b/src/sfnt/ttkern.c
@@ -85,7 +85,7 @@
 
     for ( nn = 0; nn < num_tables; nn++ )
     {
-      FT_UInt    num_pairs, length, coverage;
+      FT_UInt    num_pairs, length, coverage, format;
       FT_Byte*   p_next;
       FT_UInt32  mask = (FT_UInt32)1UL << nn;
 
@@ -107,6 +107,12 @@
       if ( p_next > p_limit )  /* handle broken table */
         p_next = p_limit;
 
+      format = coverage >> 8;
+
+      /* we currently only support format 0 kerning tables */
+      if ( format != 0 )
+        goto NextTable;
+
       /* only use horizontal kerning tables */
       if ( ( coverage & 3U ) != 0x0001 ||
            p + 8 > p_next              )