[
https://issues.apache.org/jira/browse/PDFBOX-6308?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andreas Lehmkühler reassigned PDFBOX-6308:
------------------------------------------
Assignee: Andreas Lehmkühler
> Limit charstring subroutine nesting in the Type 1 and Type 2 parsers
> --------------------------------------------------------------------
>
> Key: PDFBOX-6308
> URL: https://issues.apache.org/jira/browse/PDFBOX-6308
> Project: PDFBox
> Issue Type: Bug
> Components: FontBox
> Reporter: Sharang Gupta
> Assignee: Andreas Lehmkühler
> Priority: Minor
>
> {{Type1CharStringParser}} and {{Type2CharStringParser}} handle {{callsubr}} /
> {{callgsubr}} by parsing the subroutine recursively, and nothing limits how
> deep that goes. A font with a subroutine that calls itself (or two that call
> each other) makes the parser recurse until a {{StackOverflowError}}, which
> code catching {{IOException}} for a broken font does not handle.
> To reproduce: a Type 1 charstring that is just "0 callsubr" with subr 0 being
> the same bytes, or the Type 2 equivalent with a local or global subr that
> calls itself.
> Proposed change: count the nesting and throw an {{IOException}} beyond 100
> levels. The Type 2 spec allows 10 and FreeType 16, but fonts in use go deeper
> than the spec, so the limit is only a safeguard against endless recursion.
> I have a patch with tests for both parsers and will open a pull request. It
> was prepared with AI assistance; I reviewed it and ran the fontbox test suite.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
