1 files changed, 18 insertions, 4 deletions
diff --git a/src/core/SkReadBuffer.cpp b/src/core/SkReadBuffer.cpp
index e3651cc3a2..4a2c61be02 100644
--- a/src/core/SkReadBuffer.cpp
+++ b/src/core/SkReadBuffer.cpp
@@ -362,12 +362,26 @@ sk_sp<SkTypeface> SkReadBuffer::readTypeface() {
         return sk_ref_sp(fInflator->getTypeface(this->read32()));
     }
 
-    uint32_t index = this->readUInt();
-    if (0 == index || index > (unsigned)fTFCount) {
+    // Read 32 bits (signed)
+    //   0 -- return null (default font)
+    //  >0 -- index
+    //  <0 -- custom (serial procs) : negative size in bytes
+
+    int32_t index = this->readUInt();
+    if (index == 0) {
         return nullptr;
-    } else {
-        SkASSERT(fTFArray);
+    } else if (index > 0) {
+        if (!this->validate(index <= fTFCount)) {
+            return nullptr;
+        }
         return sk_ref_sp(fTFArray[index - 1]);
+    } else {    // custom
+        size_t size = -index;
+        const void* data = this->skip(size);
+        if (!this->validate(data != nullptr)) {
+            return nullptr;
+        }
+        return fProcs.fTypefaceProc(data, size, fProcs.fTypefaceCtx);
     }
 }