From 9fef4be0409d78901c54338a8bf828ad79e6dc42 Mon Sep 17 00:00:00 2001
From: "bashi@chromium.org"
 <bashi@chromium.org@a4e77c2c-9104-11de-800e-5b313e0d2bf3>
Date: Tue, 22 Mar 2011 19:02:34 +0000
Subject: [PATCH] Add lookup flag validation check.

Checks existence of Glyph class definition table in GDEF table if bits of lookup flags which require the table are set.

BUG=76943
TEST=test/layout_common_table_test.cc
---
 src/gdef.cc                      | 1 +
 src/gdef.h                       | 2 ++
 src/layout.cc                    | 6 ++++++
 test/layout_common_table_test.cc | 8 ++++++++
 4 files changed, 17 insertions(+)

diff --git a/src/gdef.cc b/src/gdef.cc
index 4c895d05..d5c44eab 100644
--- a/src/gdef.cc
+++ b/src/gdef.cc
@@ -306,6 +306,7 @@ bool ots_gdef_parse(OpenTypeFile *file, const uint8_t *data, size_t length) {
       DROP_THIS_TABLE;
       return true;
     }
+    gdef->has_glyph_class_def = true;
   }
 
   if (offset_attach_list) {
diff --git a/src/gdef.h b/src/gdef.h
index f896e0d5..f46f419c 100644
--- a/src/gdef.h
+++ b/src/gdef.h
@@ -12,6 +12,7 @@ namespace ots {
 struct OpenTypeGDEF {
   OpenTypeGDEF()
       : version_2(false),
+        has_glyph_class_def(false),
         has_mark_attachment_class_def(false),
         has_mark_glyph_sets_def(false),
         num_mark_glyph_sets(0),
@@ -20,6 +21,7 @@ struct OpenTypeGDEF {
   }
 
   bool version_2;
+  bool has_glyph_class_def;
   bool has_mark_attachment_class_def;
   bool has_mark_glyph_sets_def;
   uint16_t num_mark_glyph_sets;
diff --git a/src/layout.cc b/src/layout.cc
index 8f7cc4f2..9877e6c0 100644
--- a/src/layout.cc
+++ b/src/layout.cc
@@ -20,6 +20,8 @@ const uint32_t kScriptTableTagDflt = 0x44464c54;
 const uint16_t kNoRequiredFeatureIndexDefined = 0xFFFF;
 // The lookup flag bit which indicates existence of MarkFilteringSet.
 const uint16_t kUseMarkFilteringSetBit = 0x0010;
+// The lookup flags which require GDEF table.
+const uint16_t kGdefRequiredFlags = 0x0002 | 0x0004 | 0x0008;
 // The mask for MarkAttachmentType.
 const uint16_t kMarkAttachmentTypeMask = 0xFF00;
 // The maximum type number of format for device tables.
@@ -188,6 +190,10 @@ bool ParseLookupTable(ots::OpenTypeFile *file, const uint8_t *data,
   }
 
   // Check lookup flags.
+  if ((lookup_flag & kGdefRequiredFlags) &&
+      (!file->gdef || !file->gdef->has_glyph_class_def)) {
+    return OTS_FAILURE();
+  }
   if ((lookup_flag & kMarkAttachmentTypeMask) &&
       (!file->gdef || !file->gdef->has_mark_attachment_class_def)) {
     return OTS_FAILURE();
diff --git a/test/layout_common_table_test.cc b/test/layout_common_table_test.cc
index bb8170f4..47510371 100644
--- a/test/layout_common_table_test.cc
+++ b/test/layout_common_table_test.cc
@@ -508,6 +508,14 @@ TEST_F(LookupListTableTest, TesBadLookupType) {
   EXPECT_FALSE(Parse());
 }
 
+TEST_F(LookupListTableTest, TesBadLookupFlag) {
+  BuildFakeLookupListTable(&out, 1, 1);
+  // Set IgnoreBaseGlyphs(0x0002) to the lookup flag of LookupTable[0].
+  out.Seek(6);
+  out.WriteU16(0x0002);
+  EXPECT_FALSE(Parse());
+}
+
 TEST_F(LookupListTableTest, TesBadSubtableCount) {
   BuildFakeLookupListTable(&out, 1, 1);
   // Set too large sutable count of LookupTable[0].