* src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables.

Reported by Behdad.

2 files changed, 13 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index d6ba1c897..cc30bad58 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-09-11  Werner Lemberg  <wl@gnu.org>
+
+	* src/sfnt/ttkern.c (tt_face_load_kern): Reject format 2 tables.
+
+	Reported by Behdad.
+
 2017-09-09  Werner Lemberg  <wl@gnu.org>
 
 	[autofit] Improve communication with ftgrid.
diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c
index c97e5789a..53d2436ae 100644
--- a/src/sfnt/ttkern.c
+++ b/src/sfnt/ttkern.c
@@ -85,7 +85,7 @@
 
     for ( nn = 0; nn < num_tables; nn++ )
     {
-      FT_UInt    num_pairs, length, coverage;
+      FT_UInt    num_pairs, length, coverage, format;
       FT_Byte*   p_next;
       FT_UInt32  mask = (FT_UInt32)1UL << nn;
 
@@ -107,6 +107,12 @@
       if ( p_next > p_limit )  /* handle broken table */
         p_next = p_limit;
 
+      format = coverage >> 8;
+
+      /* we currently only support format 0 kerning tables */
+      if ( format != 0 )
+        goto NextTable;
+
       /* only use horizontal kerning tables */
       if ( ( coverage & 3U ) != 0x0001 ||
            p + 8 > p_next              )