Bug 543502: Protect against out-of-range array read in CheckForSimpleFamily; remove bad families with no faces from the font list. r=jdaggett

gfx/thebes/src/gfxFont.cpp

@@ -319,8 +319,9 @@ gfxFontFamily::FindFontForStyle(const gfxFontStyle& aFontStyle, PRBool& aNeedsBo
 void
 gfxFontFamily::CheckForSimpleFamily()
 {
-    if (mAvailableFonts.Length() > 4) {
-        return; // can't be "simple" if there are >4 faces
+    if (mAvailableFonts.Length() > 4 || mAvailableFonts.Length() == 0) {
+        return; // can't be "simple" if there are >4 faces;
+                // if none then the family is unusable anyway
     }
 
     PRInt16 firstStretch = mAvailableFonts[0]->Stretch();

gfx/thebes/src/gfxPlatformFontList.cpp

@@ -524,6 +524,13 @@ gfxPlatformFontList::RunLoader()
 
         // find all faces that are members of this family
         familyEntry->FindStyleVariations();
+        if (familyEntry->GetFontList().Length() == 0) {
+            // failed to load any faces for this family, so discard it
+            nsAutoString key;
+            GenerateFontListKey(familyEntry->Name(), key);
+            mFontFamilies.Remove(key);
+            continue;
+        }
 
         // load the cmaps
         familyEntry->ReadCMAP();
@@ -535,10 +542,9 @@ gfxPlatformFontList::RunLoader()
         familyEntry->CheckForSimpleFamily();
     }
 
-    mStartIndex += mIncrement;
-    if (mStartIndex < mNumFamilies)
-        return PR_FALSE;
-    return PR_TRUE;
+    mStartIndex = endIndex;
+
+    return (mStartIndex >= mNumFamilies);
 }
 
 void