Don't allow reference blob be accessed using empty tag in hb_face_reference_table (#1947)

src/hb-face.cc

@@ -367,6 +367,9 @@ hb_blob_t *
 hb_face_reference_table (const hb_face_t *face,
 			 hb_tag_t tag)
 {
+  if (unlikely (tag == HB_TAG_NONE))
+    return hb_blob_get_empty ();
+
   return face->reference_table (tag);
 }
 

src/hb-subset.cc

@@ -238,11 +238,6 @@ _subset_table (hb_subset_plan_t *plan,
 static bool
 _should_drop_table (hb_subset_plan_t *plan, hb_tag_t tag)
 {
-  if (unlikely (!tag))
-    /* Drop tables with no tag as that means table header in
-       _hb_face_builder_reference_table */
-    return true;
-
   if (plan->drop_tables->has (tag))
     return true;