You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2021/05/14 09:34:42 UTC
svn commit: r1889890 -
/pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/ttf/GlyfSimpleDescript.java
Author: tilman
Date: Fri May 14 09:34:41 2021
New Revision: 1889890
URL: http://svn.apache.org/viewvc?rev=1889890&view=rev
Log:
PDFBOX-5192: don't render glyphs with bad flags
Modified:
pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/ttf/GlyfSimpleDescript.java
Modified: pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/ttf/GlyfSimpleDescript.java
URL: http://svn.apache.org/viewvc/pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/ttf/GlyfSimpleDescript.java?rev=1889890&r1=1889889&r2=1889890&view=diff
==============================================================================
--- pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/ttf/GlyfSimpleDescript.java (original)
+++ pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/ttf/GlyfSimpleDescript.java Fri May 14 09:34:41 2021
@@ -216,8 +216,13 @@ public class GlyfSimpleDescript extends
if ((flags[index] & REPEAT) != 0)
{
int repeats = bais.readUnsignedByte();
- for (int i = 1; i <= repeats && index + i < flags.length; i++)
+ for (int i = 1; i <= repeats; i++)
{
+ if (index + i >= flags.length)
+ {
+ throw new IOException(
+ "repeat count (" + repeats + ") higher than remaining space");
+ }
flags[index + i] = flags[index];
}
index += repeats;