bug 811382 - update OTS library to r.95. r=jdaggett a=akeybl

gfx/ots/README.mozilla

@@ -1,6 +1,6 @@
 This is the Sanitiser for OpenType project, from http://code.google.com/p/ots/.
 
-Current revision: r92
+Current revision: r95
 
 Applied local patches:
     ots-fix-vc10.patch - workaround for VS10 STL wrappers (bug 602558)
@@ -10,3 +10,5 @@ Applied local patches:
     ots-graphite.patch - preserve Graphite layout tables (bug 631479)
 
     ots-visibility.patch - make Process function externally visible for Windows DLL (bug 711079)
+
+Patches from https://bugzilla.mozilla.org/show_bug.cgi?id=670901.

gfx/ots/src/cmap.cc

@@ -212,7 +212,7 @@ bool ParseFormat4(ots::OpenTypeFile *file, int platform, int encoding,
   // A format 4 CMAP subtable is complex. To be safe we simulate a lookup of
   // each code-point defined in the table and make sure that they are all valid
   // glyphs and that we don't access anything out-of-bounds.
-  for (unsigned i = 1; i < segcount; ++i) {
+  for (unsigned i = 0; i < segcount; ++i) {
     for (unsigned cp = ranges[i].start_range; cp <= ranges[i].end_range; ++cp) {
       const uint16_t code_point = cp;
       if (ranges[i].id_range_offset == 0) {

gfx/ots/src/layout.cc

@@ -394,7 +394,12 @@ bool ParseCoverageFormat2(const uint8_t *data, size_t length,
         !subtable.ReadU16(&start_coverage_index)) {
       return OTS_FAILURE();
     }
-    if (start > end || (last_end && start <= last_end)) {
+
+    // Some of the Adobe Pro fonts have ranges that overlap by one element: the
+    // start of one range is equal to the end of the previous range. Therefore
+    // the < in the following condition should be <= were it not for this.
+    // See crbug.com/134135.
+    if (start > end || (last_end && start < last_end)) {
       OTS_WARNING("glyph range is overlapping.");
       return OTS_FAILURE();
     }