(loca) Allow incomplete table.

CHANGELOG.md

@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Fixed
 - (hmtx/vmtx) Allow missing additional side bearings.
+- (loca) Allow incomplete table.
 - Reduce strictness of some table length checks.
 
 ## [0.15.2] - 2022-06-17

src/tables/loca.rs

@@ -3,6 +3,7 @@
 
 use core::num::NonZeroU16;
 use core::ops::Range;
+use core::convert::TryFrom;
 
 use crate::{GlyphId, IndexToLocationFormat};
 use crate::parser::{Stream, LazyArray16, NumFrom};
@@ -29,12 +30,26 @@ impl<'a> Table<'a> {
         // The number of ranges is `maxp.numGlyphs + 1`.
         //
         // Check for overflow first.
-        let total = if number_of_glyphs.get() == core::u16::MAX {
+        let mut total = if number_of_glyphs.get() == core::u16::MAX {
             number_of_glyphs.get()
         } else {
             number_of_glyphs.get() + 1
         };
 
+        // By the spec, the number of `loca` offsets is `maxp.numGlyphs + 1`.
+        // But some malformed fonts can have less glyphs than that.
+        // In which case we try to parse only the available offsets
+        // and do not return an error, since the expected data length
+        // would go beyond table's length.
+        //
+        // In case when `loca` has more data than needed we simply ignore the rest.
+        let actual_total = match format {
+            IndexToLocationFormat::Short => data.len() / 2,
+            IndexToLocationFormat::Long => data.len() / 4,
+        };
+        let actual_total = u16::try_from(actual_total).ok()?;
+        total = total.min(actual_total);
+
         let mut s = Stream::new(data);
         match format {
             IndexToLocationFormat::Short => {