[jira] [Commented] (PDFBOX-5191) isEmbeddingPermitted() is too restrictive on TTFs with OS2 table versions 0-2

["Larry Lynn (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/PDFBOX-5191?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17342727#comment-17342727 ] 

Larry Lynn commented on PDFBOX-5191:
------------------------------------

Prior email communication to dev mailing list
{code:java}
MIME-Version: 1.0
Date: Mon, 10 May 2021 14:41:15 -0600
Message-ID: <CA...@mail.gmail.com>
Subject: Bug related to font embedding permissions in pdfbox 2.0.21+
From: Larry Lynn <la...@workiva.com>
To: dev@pdfbox.apache.org
Content-Type: multipart/alternative; boundary="0000000000008e7c0505c1ffcced"

--0000000000008e7c0505c1ffcced
Content-Type: text/plain; charset="UTF-8"

Greetings pdfbox devs.  Longtime user, first time contributor here.

First, I'd like to thank you all for your work on this awesome piece of
software.  pdfbox is one of the powertools in our toolbox.

Second, I'd like to lodge a bug report.  As per your support policy posted
here:
https://pdfbox.apache.org/support.html
I'm contacting the mailing list first before going straight to Jira.

I think there's a bug in isEmbeddingPermitted() that makes it too
restrictive about which fonts it will embed.

The code is here:
https://github.com/apache/pdfbox/blob/trunk/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/TrueTypeEmbedder.java#L139

I believe the bug was introduced with this change
https://svn.apache.org/viewvc/pdfbox/branches/2.0/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/TrueTypeEmbedder.java?r1=1878861&r2=1878860&pathrev=1878861

For this ticket:
https://issues.apache.org/jira/browse/PDFBOX-4882

So, it looks like there was an earlier bug in isEmbeddingPermitted() that
made it too permissive.  But I think that in fixing that one, a 2nd bug was
introduced that makes it too strict.  The reason that I think there is a
bug here is because there is no check in that code for
ttf.getOS2Windows().getVersion().

In the documentation linked on PDFBOX-4882,
https://docs.microsoft.com/en-us/typography/opentype/spec/os2#fstype
Please note the section on Version Differences

"The specification for versions 0 to 2 did not specify that bits 0 to 3
must be mutually exclusive. Rather, those specifications stated that, in
the event that more than one of bits 0 to 3 are set in a given font, then
the *least-restrictive permission indicated take precedence*."

We have a font named ArialRoundedMTBold.ttf.  pdfbox versions 2.0.20 and
lower would embed this without complaint, but pdfbox version 2.0.21 and
higher throw an error when attempting to embed this font "This font does
not permit embedding".

We opened this font up in FontForge and verified that its OS/2 table is
version 1.  We stepped through this code in a debugger and found that
fsType is set to 6, so 2 permission bits are set, one for FSTYPE_RESTRICTED
& one for FSTYPE_PREVIEW_AND_PRINT. This is a legal configuration for a
version 1 font, but not a version 3 font.  The code in
isEmbeddingPermitted() is respecting the most restrictive permission bit,
which contradicts the spec.  It should be respecting the least restrictive
permission bit.

I think the code as-is is correct for version 3 fonts and above (presuming
there is no font corruption on the permission bits), but is too restrictive
on font versions 0 - 2.

I can provide code that reproduces the problem.  If you accept pull
requests from external developers, I believe that I've looked at this code
long enough that I can provide a bugfix too.

Thanks and Regards

-- 
*Larry Lynn*
*Senior Software Engineer*
*Workiva Inc*. {code}
 

Response:
{code:java}
Subject: Re: Bug related to font embedding permissions in pdfbox 2.0.21+
To: dev@pdfbox.apache.org
References: <CA...@mail.gmail.com>
From: Andreas Lehmkuehler <an...@lehmi.de>
Message-ID: <88...@lehmi.de>
Date: Tue, 11 May 2021 08:13:45 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.8.1
MIME-Version: 1.0
In-Reply-To: <CA...@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit

Hi,


thanks for your detailed report, it sounds valid and is very helpful!!

Please create a JIRA ticket and attach a patch to it. If you prefer a PR we are 
able to handle that as well (add the URL of the PR to the JIRA ticket)

Andreas
 {code}
 

> isEmbeddingPermitted() is too restrictive on TTFs with OS2 table versions 0-2
> -----------------------------------------------------------------------------
>
>                 Key: PDFBOX-5191
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-5191
>             Project: PDFBox
>          Issue Type: Bug
>          Components: PDModel
>    Affects Versions: 2.0.21, 3.0.0 PDFBox
>            Reporter: Larry Lynn
>            Priority: Major
>
> PDFBOX-4882 fixed a bug that made isEmbeddingPermitted() too permissive.  But it introduced a bug that made isEmbeddingPermitted() too restrictive for TTFs with OS2 table versions 0-2.
>  
> TTFs with OS2 table versions 0-2 can have multiple permission bits set.  According to the spec described in 
> [https://docs.microsoft.com/en-us/typography/opentype/spec/os2#fstype]
> "in the event that more than one of bits 0 to 3 are set in a given font, then the _least-restrictive permission indicated take precedence_."
> Unfortunately, the current code essentially makes the most restrictive permission take precedence.  This causes pdfbox to throw an error: 
> "This font does not permit embedding"
> when attempting to process fonts that worked fine in pdfbox v2.0.20 and lower



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org