You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2020/12/14 04:14:55 UTC
svn commit: r1884403 -
/pdfbox/branches/2.0/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/PDType1Font.java
Author: tilman
Date: Mon Dec 14 04:14:55 2020
New Revision: 1884403
URL: http://svn.apache.org/viewvc?rev=1884403&view=rev
Log:
PDFBOX-4892: avoid IllegalArgumentException in Arrays.copyOfRange()
Modified:
pdfbox/branches/2.0/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/PDType1Font.java
Modified: pdfbox/branches/2.0/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/PDType1Font.java
URL: http://svn.apache.org/viewvc/pdfbox/branches/2.0/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/PDType1Font.java?rev=1884403&r1=1884402&r2=1884403&view=diff
==============================================================================
--- pdfbox/branches/2.0/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/PDType1Font.java (original)
+++ pdfbox/branches/2.0/pdfbox/src/main/java/org/apache/pdfbox/pdmodel/font/PDType1Font.java Mon Dec 14 04:14:55 2020
@@ -234,9 +234,13 @@ public class PDType1Font extends PDSimpl
// repair Length1 and Length2 if necessary
byte[] bytes = fontFile.toByteArray();
+ if (bytes.length == 0)
+ {
+ throw new IOException("Font data unavailable");
+ }
length1 = repairLength1(bytes, length1);
length2 = repairLength2(bytes, length1, length2);
-
+
if (bytes.length > 0 && (bytes[0] & 0xff) == PFB_START_MARKER)
{
// some bad files embed the entire PFB, see PDFBOX-2607
@@ -245,6 +249,11 @@ public class PDType1Font extends PDSimpl
else
{
// the PFB embedded as two segments back-to-back
+ if (length1 < 0 || length1 > length1 + length2)
+ {
+ throw new IOException("Invalid length data, actual length: " +
+ bytes.length + ", /Length1: " + length1 + ", /Length2: " + length2);
+ }
byte[] segment1 = Arrays.copyOfRange(bytes, 0, length1);
byte[] segment2 = Arrays.copyOfRange(bytes, length1, length1 + length2);