Sharang Gupta created PDFBOX-6308:
-------------------------------------
Summary: Limit charstring subroutine nesting in the Type 1 and
Type 2 parsers
Key: PDFBOX-6308
URL: https://issues.apache.org/jira/browse/PDFBOX-6308
Project: PDFBox
Issue Type: Bug
Components: FontBox
Reporter: Sharang Gupta
{{Type1CharStringParser}} and {{Type2CharStringParser}} handle {{callsubr}} /
{{callgsubr}} by parsing the subroutine recursively, and nothing limits how
deep that goes. A font with a subroutine that calls itself (or two that call
each other) makes the parser recurse until a {{StackOverflowError}}, which code
catching {{IOException}} for a broken font does not handle.
To reproduce: a Type 1 charstring that is just "0 callsubr" with subr 0 being
the same bytes, or the Type 2 equivalent with a local or global subr that calls
itself.
Proposed change: count the nesting and throw an {{IOException}} beyond 100
levels. The Type 2 spec allows 10 and FreeType 16, but fonts in use go deeper
than the spec, so the limit is only a safeguard against endless recursion.
I have a patch with tests for both parsers and will open a pull request. It was
prepared with AI assistance; I reviewed it and ran the fontbox test suite.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
