THausherr commented on PR #532:
URL: https://github.com/apache/pdfbox/pull/532#issuecomment-5789110372
Please merge the latest changes from the trunk, I have removed the trailing
spaces so that the actual change is better visible.
Here's the latest copilot comments:
Blocking review comments
fontbox/src/main/java/org/apache/fontbox/ttf/BytecodeStream.java, around
nextByte() and nextWord() — setEnd() establishes a function-body limit, and
seek() honors that limit, but both read methods only check code.length.
Consequently, a PUSHB/PUSHW operand at the end of a function body can consume
bytes beyond the matching ENDF, including instructions from the surrounding
program. This defeats the function-boundary protection and can produce
incorrect execution or allow malformed font bytecode to escape its function
body. Both methods should validate against limit rather than code.length, and
nextWord() should verify that both bytes remain within the limit.
BytecodeStream.java
@@
public int nextByte()
{
- if (ip >= code.length)
+ if (ip >= limit)
{
Other important findings
fontbox/src/main/java/org/apache/fontbox/ttf/TrueTypeInterpreter.java,
jump/function handling — Add an explicit regression test for a PUSHW or PUSHB
whose operand bytes straddle the function limit. The current tests cover jumps
out of a function body, but not operand reads crossing the limit, so they would
not catch the defect above.
TrueTypeInterpreterTest.java
@@
+@Test
+void testFunctionBodyCannotReadOperandsPastEndf()
+{
+ // The PUSHW is positioned so its second operand would be ENDF or code
after ENDF.
+ // The interpreter must reject the read rather than consume bytes
outside the body.
fontbox/src/test/resources/ttf/hinting/generate_golden.py and README.md
— The documentation describes inconsistent FreeType targets: the generator uses
FT_LOAD_TARGET_NORMAL, while the README describes monochrome/full-pixel tracing
in places and the tests claim grayscale/v40 behavior. The golden-test contract
should state one exact FreeType load target and use the same target in all
scripts and documentation; otherwise regenerated reference files may silently
validate a different interpreter mode.
fontbox/src/main/java/org/apache/fontbox/ttf/GlyphHinter.java — The
implementation silently returns null for all composites when the component
assembly or hinting path fails, causing the renderer to fall back to the raw
outline. That is a reasonable resilience policy, but the tests should
distinguish “unsupported composite hinting” from “successful composite hinting”
and assert that representative composites actually receive instructions and
produce the intended hinted result.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
