The
font for this test case
is an OpenType version of the
Billion
laughs attack. Its
GSUB table contains a sequence of
nine identical lookups. Each lookup replaces the glyph
o by
the string
olololololololololo, provided that the
o is surrounded (both preceded and followed) by an
l. The first lookup thus expands one single laugh
(lol) into ten. The second lookup gives 100 laughs; the
third 1000; the fourth 10,000; the fifth 100,000; and so forth.
After executing the ninth lookup, the final result would be a
billion laughs, but this takes a very long time (and large amounts
of memory) to compute. If your implementation is immune to this
attack, it should neither crash nor hang when rendering
lol
with this font. Instead, your implementation should stop executing
once its internal buffer has reached a size limit. See also
fontkit
bug 221.