Re: How did this ever become a problem in the first place?
TrueType fonts are normally just "a bunch of vectors" but can also contain a whole program. This isn't very common: it's normally use for hinting, and nobody bothers with hinting, but we have a few fonts that use this table to shape the glyphs. Which is ****ing annoying.
Spec is at https://www.microsoft.com/typography/otspec/ttinst.htm, here's a snippet of example code:
PUSHB 23 17 1 /* PUSH : jump1, jump2, rast. version flag */
GETINFO /* get the rasterizer version */
JROT /* we are at MS rasterizer version 1.7 or higher (> 34) */
As you can see there's a lot of room here for poor bounds checking to do some damage. I didn't read their bug report and I've no idea if the fault they found is in this section, but knowing the spec, I can't see where else it would be.
(We've written our own TrueType font parser due to the holes in the one supplied with the JVM)
(edit: El Reg, a newline at the end of the line means one line break, not two! Sort your editor out. No, not Andrew, the text editor)