Hello -

We encountered an infinite loop on fontbox-3.0.4.

I have both a sample pdf document and a proposed fix to
o.a.f.cmap.CMapParser that I would like to provide. My self-serve request
for an account to create a ticket was denied.

I have bisected the fontbox versions to see that the infinite loop is
triggered as of -3.0.3, but the issue is latent there in
CMapParser.readNumber before that, just not triggered on this document from
what I can tell.

In order to produce a shareable file from the proprietary document we
encountered I used o.a.p.tools.PDFSplit -split 1, verified a page that
demonstrated the problem, then o.a.p.tools.WriteDecodedDoc to get a version
that was easier work with and removed the proprietary content.

By debugging through the CMapParser it appears the problem section of the
PDF hosted here:

https://limewire.com/d/dd78e66a-13fb-4326-b1fe-9dcb8cc35b35#VCo8UH6-QWQoKK_CtvIV38Cu9Wbh1Sl9-IzZ7ytKsps

is with the very short stream on line 225/226.

This patch fixes the infinite loop and all tests still pass.
```
diff --git a/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
b/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
index ed25746fc2..f4880ba768 100644
--- a/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
+++ b/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
@@ -652,7 +652,10 @@ public class CMapParser
             buffer.append((char) nextByte);
             nextByte = randomAcccessRead.read();
         }
+        if (nextByte != -1)
+        {
             randomAcccessRead.rewind(1);
+        }
         String value = buffer.toString();
         try
         {
```

Thanks,
Mike

Reply via email to