From f5796bccfbf845269f6a5d92de65249d0fb8c6d6 Mon Sep 17 00:00:00 2001
From: Dominik Röttsches <drott@chromium.org>
Date: Mon, 21 Sep 2026 02:42:30 -0700
Subject: [PATCH] [OTS] Add patch to validate CFF1 charset and encoding operands

Add a subset of the upstream change
5c681204ed7ec95971598b27d247247b3aa4d78b to address the immediate
problem until we take care of an OTS roll.

Fixed: 505807063
Change-Id: Ib825d12a1ee09022b2da7c8b66d2908206411942
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8422762
Auto-Submit: Dominik Röttsches <drott@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1701627}
---
diff --git a/third_party/ots/README.chromium b/third_party/ots/README.chromium
index 8fd25016..140e308 100644
--- a/third_party/ots/README.chromium
+++ b/third_party/ots/README.chromium
@@ -11,3 +11,9 @@
 Local Modifications:
 - BUILD.gn: Added.
 - fuzz/: Added.
+- patches/0001-cff-bcd-operands.patch: Validate operand types for charset and
+  Encoding operators in CFF1 table to prevent BCD operand bypasses
+  (crbug.com/505807063). This is a subset of upstream commit
+  5c681204ed7ec95971598b27d247247b3aa4d78b (PR #314), which introduces the
+  Operand class; this change should be subsumed under a future OTS roll.
+
diff --git a/third_party/ots/patches/0001-cff-bcd-operands.patch b/third_party/ots/patches/0001-cff-bcd-operands.patch
new file mode 100644
index 0000000..3a080fb
--- /dev/null
+++ b/third_party/ots/patches/0001-cff-bcd-operands.patch
@@ -0,0 +1,45 @@
+From: Chromium Authors
+Subject: [cff] Validate operand type for charset and Encoding operators
+
+Enforce DICT_OPERAND_INTEGER for charset (case 15) and Encoding (case 16)
+operands in the CFF1 parser before checking predefined constants (first <= 2
+and first <= 1).
+
+Without this check, Binary Coded Decimal (BCD) operands, which OTS stores with
+a dummy integer value of 0 and DICT_OPERAND_REAL type, satisfy the predefined
+range check and skip CheckOffset, allowing unvalidated offsets to pass through.
+
+This is a subset of upstream commit
+5c681204ed7ec95971598b27d247247b3aa4d78b (PR #314), which introduces the
+Operand class; this change should be subsumed under a future OTS roll.
+
+Bug: 505807063
+---
+ src/cff.cc | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/cff.cc b/src/cff.cc
+index af54a4a..bc64136 100644
+--- a/src/cff.cc
++++ b/src/cff.cc
+@@ -778,6 +778,9 @@ bool ParseDictData(ots::Buffer& table, ots::Buffer& dict,
+         if (operands.size() != 1) {
+           return OTS_FAILURE();
+         }
++        if (operands.back().second != DICT_OPERAND_INTEGER) {
++          return OTS_FAILURE();
++        }
+         if (operands.back().first <= 2) {
+           // predefined charset, ISOAdobe, Expert or ExpertSubset, is used.
+           break;
+@@ -795,6 +798,9 @@ bool ParseDictData(ots::Buffer& table, ots::Buffer& dict,
+         if (operands.size() != 1) {
+           return OTS_FAILURE();
+         }
++        if (operands.back().second != DICT_OPERAND_INTEGER) {
++          return OTS_FAILURE();
++        }
+         if (operands.back().first <= 1) {
+           break;  // predefined encoding, "Standard" or "Expert", is used.
+         }
+--