--- a/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables.cpp	Tue Mar 10 13:30:11 2015 +0300
+++ b/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables.cpp	Tue Mar 10 14:00:05 2015 -0700
@@ -54,6 +54,10 @@
     for (chain = 0; LE_SUCCESS(success) && (chain < chainCount); chain += 1) {
         if (chain > 0) {
             le_uint32 chainLength = SWAPL(chainHeader->chainLength);
+            if (chainLength & 0x03) { // incorrect alignment for 32 bit tables
+                success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
+                return;
+            }
             chainHeader.addOffset(chainLength, success);
         }
         FeatureFlags defaultFlags = SWAPL(chainHeader->defaultFlags);
@@ -66,6 +70,10 @@
         for (subtable = 0; LE_SUCCESS(success) && (subtable < nSubtables); subtable += 1) {
             if (subtable > 0) {
                 le_int16 length = SWAPW(subtableHeader->length);
+                if (length & 0x03) { // incorrect alignment for 32 bit tables
+                    success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
+                    return;
+                }
                 subtableHeader.addOffset(length, success);
             }
             SubtableCoverage coverage = SWAPW(subtableHeader->coverage);

--- a/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables2.cpp	Tue Mar 10 13:30:11 2015 +0300
+++ b/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables2.cpp	Tue Mar 10 14:00:05 2015 -0700
@@ -59,6 +59,10 @@
   for (chain = 0; LE_SUCCESS(success) && (chain < chainCount); chain++) {
         if (chain>0) {
           le_uint32 chainLength = SWAPL(chainHeader->chainLength);
+          if (chainLength & 0x03) { // incorrect alignment for 32 bit tables
+              success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
+              return;
+          }
           chainHeader.addOffset(chainLength, success); // Don't increment the first time
         }
         FeatureFlags flag = SWAPL(chainHeader->defaultFlags);
@@ -188,6 +192,10 @@
         for (subtable = 0;  LE_SUCCESS(success) && subtable < nSubtables; subtable++) {
             if(subtable>0)  {
               le_uint32 length = SWAPL(subtableHeader->length);
+              if (length & 0x03) { // incorrect alignment for 32 bit tables
+                  success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any
+                  return;
+              }
               subtableHeader.addOffset(length, success); // Don't addOffset for the last entry.
             }
             le_uint32 coverage = SWAPL(subtableHeader->coverage);