Add glyph substituion limit in GSUB for all multiplesubst substitutions

Author: zeonzip

src/gsub.rs

@@ -27,6 +27,7 @@ use crate::unicode::VariationSelector;
 use crate::{tag, GlyphId};
 
 const SUBST_RECURSION_LIMIT: usize = 2;
+const MAX_GLYPHS: usize = 10_000;
 
 #[derive(Copy, Clone, Eq, PartialEq, Debug)]
 pub struct FeatureInfo {
@@ -462,6 +463,10 @@ fn multiplesubst<T: GlyphData>(
 ) -> Result<Option<usize>, ParseError> {
     match multiplesubst_would_apply(subtables, i, glyphs)? {
         Some(sequence_table) => {
+            if sequence_table.substitute_glyphs.len() + glyphs.len() >= MAX_GLYPHS {
+                return Err(ParseError::LimitExceeded);
+            }
+
             if !sequence_table.substitute_glyphs.is_empty() {
                 let first_glyph_index = sequence_table.substitute_glyphs[0];
                 glyphs[i].glyph_index = first_glyph_index;

src/layout.rs

@@ -1450,7 +1450,7 @@ pub struct MultipleSubst {
 }
 
 pub struct SequenceTable {
-    pub substitute_glyphs: Vec<u16>,
+    pub substitute_glyphs: Vec<GlyphId>,
 }
 
 impl ReadBinaryDep for MultipleSubst {