I propose we sanitize all downloaded fonts before we pass them to any platform font code. We could use the sanitizer at http://code.google.com/p/ots/ as a starting point. Sanitization would (among other things) strip all tables that are not known to be needed for glyph measurement and rasterization. We would continue to provide full tables to Harfbuzz.

Dupe of 527276?