From da0f28174020cf8b8606ea01c7b09c51155eb830 Mon Sep 17 00:00:00 2001
From: Simon Steiner <ssteiner@apache.org>
Date: Tue, 14 Jan 2020 12:21:21 +0000
Subject: [PATCH] FOP-2902: Ignore TTF reserved index range

git-svn-id: https://svn.apache.org/repos/asf/xmlgraphics/fop/trunk@1872774 13f79535-47bb-0310-9956-ffa450edef68
---
 .../apache/fop/fonts/truetype/OpenFont.java   |  2 +-
 .../fop/fonts/truetype/TTFFileTestCase.java   | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/fop-core/src/main/java/org/apache/fop/fonts/truetype/OpenFont.java b/fop-core/src/main/java/org/apache/fop/fonts/truetype/OpenFont.java
index 3d15fc4d8..5076e3064 100644
--- a/fop-core/src/main/java/org/apache/fop/fonts/truetype/OpenFont.java
+++ b/fop-core/src/main/java/org/apache/fop/fonts/truetype/OpenFont.java
@@ -1406,7 +1406,7 @@ public abstract class OpenFont {
             for (int i = 0; i < l; i++) {
                 mtxTab[i].setIndex(fontFile.readTTFUShort());
 
-                if (mtxTab[i].getIndex() > numGlyphStrings) {
+                if (mtxTab[i].getIndex() > numGlyphStrings && mtxTab[i].getIndex() <= 32767) {
                     numGlyphStrings = mtxTab[i].getIndex();
                 }
 
diff --git a/fop-core/src/test/java/org/apache/fop/fonts/truetype/TTFFileTestCase.java b/fop-core/src/test/java/org/apache/fop/fonts/truetype/TTFFileTestCase.java
index 325c32696..c2d84482f 100644
--- a/fop-core/src/test/java/org/apache/fop/fonts/truetype/TTFFileTestCase.java
+++ b/fop-core/src/test/java/org/apache/fop/fonts/truetype/TTFFileTestCase.java
@@ -19,9 +19,13 @@
 
 package org.apache.fop.fonts.truetype;
 
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.DataOutputStream;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -572,4 +576,23 @@ public class TTFFileTestCase {
         assertEquals(dejavuTTFFile.getBBox(1)[0], 49);
         assertEquals(dejavuTTFFile.getBBox(2330).length, 4);
     }
+
+    @Test
+    public void testReservedIndex() throws IOException {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        DataOutputStream dos = new DataOutputStream(bos);
+        dos.write(0);
+        dos.write(2);
+        for (int i = 0; i < 31; i++) {
+            dos.write(0);
+        }
+        dos.write(1); //number of glyphs
+        dos.writeShort(32768); //index value
+        TTFFile ttfFile = new TTFFile();
+        ttfFile.dirTabs = new HashMap<OFTableName, OFDirTabEntry>();
+        ttfFile.fontFile = new FontFileReader(new ByteArrayInputStream(bos.toByteArray()));
+        ttfFile.mtxTab = new OFMtxEntry[1];
+        ttfFile.mtxTab[0] = new OFMtxEntry();
+        ttfFile.readPostScript();
+    }
 }
-- 
2.39.5