font/sfnt: fix hmtx table size validation

The library assumes the hmtx size to be equal to 2*nGlyph + 2*nHm,
which is a simplification of 4*nHm + 2*(nGlyph-nHm) as described
in the spec. However, fonts seen in the wild sometimes omit the
second term (left side bearings), making validation to fail.

CL fixes the validation code by allowing to omit the second term.

Fixes golang/go#28379

Change-Id: I2293e498e72f95e5fe08c2b375ea7b020d06cde3
Reviewed-by: Nigel Tao <>
diff --git a/font/sfnt/sfnt.go b/font/sfnt/sfnt.go
index eaae675..7a8effd 100644
--- a/font/sfnt/sfnt.go
+++ b/font/sfnt/sfnt.go
@@ -904,7 +904,10 @@
 func (f *Font) parseHmtx(buf []byte, numGlyphs, numHMetrics int32) (buf1 []byte, err error) {
-	if f.hmtx.length != uint32(2*numGlyphs+2*numHMetrics) {
+	// The spec says that the hmtx table's length should be
+	// "4*numHMetrics+2*(numGlyphs-numHMetrics)". However, some fonts seen in the
+	// wild omit the "2*(nG-nHM)". See
+	if f.hmtx.length != uint32(4*numHMetrics) && f.hmtx.length != uint32(4*numHMetrics+2*(numGlyphs-numHMetrics)) {
 		return nil, errInvalidHmtxTable
 	return buf, nil