1. These fonts appear to have some glyphs with zero or incomplete contours.
The T2k implementation with asserts enabled will trigger an assert
on countourCount ==0 in New_GlyphClass(..)
If asserts are turned off it will SEGV by deferencing a pointer
that hasn't been allocated.
Also if contourCount > 0 but there is only 1 contour and it says that
the final endpoint is point 0 (ep=0, so stmp == 1) then we don't
have a valid contour
The fix is
- initialise to null some fields that should have been but weren't
- in the event zero contours return NULL from New_GlyphClass()
- in the event of the only contour having only 1 pt also return NULL
- make the caller return an empty glyph instead of asserting on a NULL
2. The code in New_hmtxClass and *New_hmtxEmptyClass in truetype.c
allocates arrays of length numGlyphs, but then reads into this array
numberOfHMetrics entries. The latter figure is obtained from the hhea
table. Normally this is OK since numberOfHMetrics is normally not greater
than numberOfHMetrics but in these fonts it is. This causes random crashes.
There are supposed to be at least numberOfHMetrics entries, but if that
value is < numGlyphs its becasue the rest is supposedly an array of LSB.
So the fix is that if numberOfHMetrics > numGlyphs allocate an array
big enough to hold it even if we aren't exactly sure where that extra
data is used.