Check if glyph are stored outside the glyf table

diff --git a/src/fonts.js b/src/fonts.js
index 0f9b6f9d09f4343f836882be50b7e5986817780d..23a08c0c7418dab010b03256b7f37475bd28ed1c 100644 (file)
--- a/src/fonts.js
+++ b/src/fonts.js
@@ -1636,12 +1636,20 @@ var Font = (function FontClosure() {
         var locaData = loca.data;
         // removing the invalid glyphs
         var oldGlyfData = glyf.data;
-        var newGlyfData = new Uint8Array(oldGlyfData.length);
+        var oldGlyfDataLength = oldGlyfData.length;
+        var newGlyfData = new Uint8Array(oldGlyfDataLength);
         var startOffset = itemDecode(locaData, 0);
         var writeOffset = 0;
         itemEncode(locaData, 0, writeOffset);
         for (var i = 0, j = itemSize; i < numGlyphs; i++, j += itemSize) {
           var endOffset = itemDecode(locaData, j);
+          if (endOffset > oldGlyfDataLength) {
+            // glyph end offset points outside glyf data, rejecting the glyph
+            itemEncode(locaData, j, writeOffset);
+            startOffset = endOffset;
+            continue;
+          }
+
           var newLength = sanitizeGlyph(oldGlyfData, startOffset, endOffset,
                                         newGlyfData, writeOffset);
           writeOffset += newLength;

diff --git a/test/pdfs/.gitignore b/test/pdfs/.gitignore
index e0926492b647a846d7b7f277972054004c7b16ab..7e79f90f0b202db213e25dd58fa1a94155c3f02f 100644 (file)
--- a/test/pdfs/.gitignore
+++ b/test/pdfs/.gitignore
@@ -20,6 +20,7 @@
 !scan-bad.pdf
 !freeculture.pdf
 !issue918.pdf
+!issue1249.pdf
 !smaskdim.pdf
 !type4psfunc.pdf
 !S2.pdf

diff --git a/test/pdfs/issue1249.pdf b/test/pdfs/issue1249.pdf
new file mode 100644 (file)
index 0000000..f7bacda
Binary files /dev/null and b/test/pdfs/issue1249.pdf differ

diff --git a/test/test_manifest.json b/test/test_manifest.json
index e09f16da92ad11cd39f457d0ac9d01926144ec53..19d25317aa87598cc3ec6054010e7cdc520b6fad 100644 (file)
--- a/test/test_manifest.json
+++ b/test/test_manifest.json
@@ -417,6 +417,12 @@
       "link": true,
       "type": "eq"
     },
+    {  "id": "issue1249-load",
+      "file": "pdfs/issue1249.pdf",
+      "md5": "4f81339fa09422a7db980f34ea963609",
+      "rounds": 1,
+      "type": "load"
+    },
     {  "id": "liveprogramming",
       "file": "pdfs/liveprogramming.pdf",
       "md5": "7bd4dad1188232ef597d36fd72c33e52",