font/sfnt: fix hmtx table size validation

The library assumes the hmtx size to be equal to 2*nGlyph + 2*nHm,
which is a simplification of 4*nHm + 2*(nGlyph-nHm) as described
in the spec. However, fonts seen in the wild sometimes omit the
second term (left side bearings), making validation to fail.

CL fixes the validation code by allowing to omit the second term.

Fixes golang/go#28379

Change-Id: I2293e498e72f95e5fe08c2b375ea7b020d06cde3
Reviewed-on: https://go-review.googlesource.com/c/144080
Reviewed-by: Nigel Tao <nigeltao@golang.org>

 font/sfnt/sfnt.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/font/sfnt/sfnt.go b/font/sfnt/sfnt.go
index eaae675..7a8effd 100644
--- a/font/sfnt/sfnt.go
+++ b/font/sfnt/sfnt.go
@@ -904,7 +904,10 @@ func (f *Font) parseHhea(buf []byte, numGlyphs int32) (buf1 []byte, ascent, desc
 func (f *Font) parseHmtx(buf []byte, numGlyphs, numHMetrics int32) (buf1 []byte, err error) {
 	// https://www.microsoft.com/typography/OTSPEC/hmtx.htm
 
-	if f.hmtx.length != uint32(2*numGlyphs+2*numHMetrics) {
+	// The spec says that the hmtx table's length should be
+	// "4*numHMetrics+2*(numGlyphs-numHMetrics)". However, some fonts seen in the
+	// wild omit the "2*(nG-nHM)". See https://github.com/golang/go/issues/28379
+	if f.hmtx.length != uint32(4*numHMetrics) && f.hmtx.length != uint32(4*numHMetrics+2*(numGlyphs-numHMetrics)) {
 		return nil, errInvalidHmtxTable
 	}
 	return buf, nil