khaledhosny / ots

Sanitizer for OpenType
BSD 3-Clause "New" or "Revised" License
263 stars 63 forks source link

[cff] correctly parse negative operands, but don't allow -ve offset #270

Closed jfkthame closed 10 months ago

jfkthame commented 10 months ago

This is @nagyatosz's patch from https://github.com/khaledhosny/ots/pull/269, plus a change to explicitly reject negative offsets. Although the spec does not seem to prohibit them, support in implementations is patchy, and AFAIK no mainstream tool or workflow will generate such a font. So it seems safer to reject them than to allow such an untested niche feature that implementations may mishandle.

@khaledhosny WDYT of doing something like this? We could reconsider if there's evidence of a real-world need to support this, though discussion indicated that not all engines would actually work with such a font.