GSUB-3: Substituting a Billion Laughs

The font for this test case is an OpenType version of the Billion laughs attack. Its GSUB table contains a sequence of nine identical lookups. Each lookup replaces the glyph o by the string olololololololololo, provided that the o is surrounded (both preceded and followed) by an l. The first lookup thus expands one single laugh (lol) into ten. The second lookup gives 100 laughs; the third 1000; the fourth 10,000; the fifth 100,000; and so forth. After executing the ninth lookup, the final result would be a billion laughs, but this takes a very long time (and large amounts of memory) to compute. If your implementation is immune to this attack, it should neither crash nor hang when rendering lol with this font. Instead, your implementation should stop executing once its internal buffer has reached a size limit. See also fontkit bug 221.
Expected Shouldn’t crash
Conformance