From f441a7c00837fbe7843df6faedd5f6383c2258c3 Mon Sep 17 00:00:00 2001
From: Ebrahim Byagowi <ebrahim@gnu.org>
Date: Sun, 1 Sep 2019 02:18:09 +0430
Subject: [PATCH] Don't allow reference blob be accessed using empty tag in
 hb_face_reference_table (#1947)

---
 src/hb-face.cc   | 3 +++
 src/hb-subset.cc | 5 -----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/hb-face.cc b/src/hb-face.cc
index 1098adb33..0c9949fff 100644
--- a/src/hb-face.cc
+++ b/src/hb-face.cc
@@ -367,6 +367,9 @@ hb_blob_t *
 hb_face_reference_table (const hb_face_t *face,
 			 hb_tag_t tag)
 {
+  if (unlikely (tag == HB_TAG_NONE))
+    return hb_blob_get_empty ();
+
   return face->reference_table (tag);
 }
 
diff --git a/src/hb-subset.cc b/src/hb-subset.cc
index c4583e57f..c0752acc1 100644
--- a/src/hb-subset.cc
+++ b/src/hb-subset.cc
@@ -238,11 +238,6 @@ _subset_table (hb_subset_plan_t *plan,
 static bool
 _should_drop_table (hb_subset_plan_t *plan, hb_tag_t tag)
 {
-  if (unlikely (!tag))
-    /* Drop tables with no tag as that means table header in
-       _hb_face_builder_reference_table */
-    return true;
-
   if (plan->drop_tables->has (tag))
     return true;