7 files changed, 30 insertions, 14 deletions
diff --git a/src/gui/text/qfontengine.cpp b/src/gui/text/qfontengine.cpp
index 83e64a51a6..d654772e86 100644
--- a/src/gui/text/qfontengine.cpp
+++ b/src/gui/text/qfontengine.cpp
@@ -937,14 +937,31 @@ void QFontEngine::getUnscaledGlyph(glyph_t glyph, QPainterPath *path, glyph_metr
     addGlyphsToPath(&glyph, &p, 1, path, QFlag(0));
 }
 
+/*!
+    Returns \c true if the font table idetified by \a tag exists in the font;
+    returns \c false otherwise.
+
+    If \a buffer is NULL, stores the size of the buffer required for the font table data,
+    in bytes, in \a length. If \a buffer is not NULL and the capacity
+    of the buffer, passed in \a length, is sufficient to store the font table data,
+    also copies the font table data to \a buffer.
+
+    Note: returning \c false when the font table exists could lead to an undefined behavior.
+*/
+bool QFontEngine::getSfntTableData(uint tag, uchar *buffer, uint *length) const
+{
+    Q_UNUSED(tag)
+    Q_UNUSED(buffer)
+    Q_UNUSED(length)
+    return false;
+}
+
 QByteArray QFontEngine::getSfntTable(uint tag) const
 {
     QByteArray table;
     uint len = 0;
     if (!getSfntTableData(tag, 0, &len))
         return table;
-    if (!len)
-        return table;
     table.resize(len);
     if (!getSfntTableData(tag, reinterpret_cast<uchar *>(table.data()), &len))
         return QByteArray();
diff --git a/src/gui/text/qfontengine_ft.cpp b/src/gui/text/qfontengine_ft.cpp
index c13f60ff69..43e24b3943 100644
--- a/src/gui/text/qfontengine_ft.cpp
+++ b/src/gui/text/qfontengine_ft.cpp
@@ -125,6 +125,7 @@ static bool ft_getSfntTable(void *user_data, uint tag, uchar *buffer, uint *leng
         FT_ULong len = *length;
         result = FT_Load_Sfnt_Table(face, tag, 0, buffer, &len) == FT_Err_Ok;
         *length = len;
+        Q_ASSERT(!result || int(*length) > 0);
     }
 
     return result;
diff --git a/src/gui/text/qfontengine_p.h b/src/gui/text/qfontengine_p.h
index 0bfb9e70e2..72f5c092dd 100644
--- a/src/gui/text/qfontengine_p.h
+++ b/src/gui/text/qfontengine_p.h
@@ -144,8 +144,8 @@ public:
     };
     virtual Properties properties() const;
     virtual void getUnscaledGlyph(glyph_t glyph, QPainterPath *path, glyph_metrics_t *metrics);
-    QByteArray getSfntTable(uint /*tag*/) const;
-    virtual bool getSfntTableData(uint /*tag*/, uchar * /*buffer*/, uint * /*length*/) const { return false; }
+    QByteArray getSfntTable(uint tag) const;
+    virtual bool getSfntTableData(uint tag, uchar *buffer, uint *length) const;
 
     struct FaceId {
         FaceId() : index(0), encoding(0) {}
diff --git a/src/gui/text/qharfbuzzng.cpp b/src/gui/text/qharfbuzzng.cpp
index c09f27b665..31bb6f38f2 100644
--- a/src/gui/text/qharfbuzzng.cpp
+++ b/src/gui/text/qharfbuzzng.cpp
@@ -625,7 +625,7 @@ _hb_qt_reference_table(hb_face_t * /*face*/, hb_tag_t tag, void *user_data)
     Q_ASSERT(get_font_table);
 
     uint length = 0;
-    if (Q_UNLIKELY(!get_font_table(data->user_data, tag, 0, &length) || length == 0))
+    if (Q_UNLIKELY(!get_font_table(data->user_data, tag, 0, &length)))
         return hb_blob_get_empty();
 
     char *buffer = (char *)malloc(length);
diff --git a/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm b/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
index 4fe78cb568..7ec59f552f 100644
--- a/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
+++ b/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
@@ -659,16 +659,13 @@ bool QCoreTextFontEngine::canRender(const QChar *string, int len)
 bool QCoreTextFontEngine::getSfntTableData(uint tag, uchar *buffer, uint *length) const
 {
     QCFType<CFDataRef> table = CTFontCopyTable(ctfont, tag, 0);
-    if (!table || !length)
+    if (!table)
         return false;
     CFIndex tableLength = CFDataGetLength(table);
-    int availableLength = *length;
-    *length = tableLength;
-    if (buffer) {
-        if (tableLength > availableLength)
-            return false;
+    if (buffer && int(*length) >= tableLength)
         CFDataGetBytes(table, CFRangeMake(0, tableLength), buffer);
-    }
+    *length = tableLength;
+    Q_ASSERT(int(*length) > 0);
     return true;
 }
 
diff --git a/src/plugins/platforms/windows/qwindowsfontengine.cpp b/src/plugins/platforms/windows/qwindowsfontengine.cpp
index 86fcb666b0..79615e79ec 100644
--- a/src/plugins/platforms/windows/qwindowsfontengine.cpp
+++ b/src/plugins/platforms/windows/qwindowsfontengine.cpp
@@ -1032,6 +1032,7 @@ bool QWindowsFontEngine::getSfntTableData(uint tag, uchar *buffer, uint *length)
     SelectObject(hdc, hfont);
     DWORD t = qbswap<quint32>(tag);
     *length = GetFontData(hdc, t, 0, buffer, *length);
+    Q_ASSERT(*length == GDI_ERROR || int(*length) > 0);
     return *length != GDI_ERROR;
 }
 
diff --git a/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp b/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp
index 1c5e4508ac..158eee6b38 100644
--- a/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp
+++ b/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp
@@ -282,8 +282,8 @@ bool QWindowsFontEngineDirectWrite::getSfntTableData(uint tag, uchar *buffer, ui
             ret = true;
             if (buffer && *length >= tableSize)
                 memcpy(buffer, tableData, tableSize);
-            else
-                *length = tableSize;
+            *length = tableSize;
+            Q_ASSERT(int(*length) > 0);
         }
         m_directWriteFontFace->ReleaseFontTable(tableContext);
     } else {