bug 580719 - pt3 - improve sanity-checking of 'head' table in downloaded fonts. r=jdaggett a=blocking2.0

gfx/thebes/gfxFontUtils.cpp

@@ -1202,6 +1202,11 @@ gfxFontUtils::ValidateSFNTHeaders(const PRUint8 *aFontData,
     // -- head table data
     const HeadTable *headData = reinterpret_cast<const HeadTable*>(aFontData + headOffset);
 
+    if (headData->tableVersionNumber != HeadTable::HEAD_VERSION) {
+        NS_WARNING("invalid font (head table version)");
+        return PR_FALSE;
+    }
+
     if (headData->magicNumber != HeadTable::HEAD_MAGIC_NUMBER) {
         NS_WARNING("invalid font (head magic number)");
         return PR_FALSE;
@@ -1970,8 +1975,10 @@ gfxFontUtils::MakeEOTHeader(const PRUint8 *aFontData, PRUint32 aFontDataLength,
     // -- head table data
     const HeadTable  *headData = reinterpret_cast<const HeadTable*>(aFontData + headOffset);
 
-    if (headData->magicNumber != HeadTable::HEAD_MAGIC_NUMBER)
+    if (headData->tableVersionNumber != HeadTable::HEAD_VERSION ||
+        headData->magicNumber != HeadTable::HEAD_MAGIC_NUMBER) {
         return NS_ERROR_FAILURE;
+    }
 
     eotHeader->checkSumAdjustment = headData->checkSumAdjustment;
 

gfx/thebes/gfxFontUtils.h

@@ -370,6 +370,7 @@ private:
 
 struct HeadTable {
     enum {
+        HEAD_VERSION = 0x00010000,
         HEAD_MAGIC_NUMBER = 0x5F0F3CF5,
         HEAD_CHECKSUM_CALC_CONST = 0xB1B0AFBA
     };