Merge branch 'master' of git://github.com/mozilla/pdf.js.git into tree-84

README.md

@@ -1,5 +1,5 @@
 # PDF.JS
-
+ 
 
 pdf.js is an HTML5 technology experiment that explores building a faithful
 and efficient Portable Document Format (PDF) renderer without native code 

src/fonts.js

@@ -1621,12 +1621,20 @@ var Font = (function FontClosure() {
         var locaData = loca.data;
         // removing the invalid glyphs
         var oldGlyfData = glyf.data;
-        var newGlyfData = new Uint8Array(oldGlyfData.length);
+        var oldGlyfDataLength = oldGlyfData.length;
+        var newGlyfData = new Uint8Array(oldGlyfDataLength);
         var startOffset = itemDecode(locaData, 0);
         var writeOffset = 0;
         itemEncode(locaData, 0, writeOffset);
         for (var i = 0, j = itemSize; i < numGlyphs; i++, j += itemSize) {
           var endOffset = itemDecode(locaData, j);
+          if (endOffset > oldGlyfDataLength) {
+            // glyph end offset points outside glyf data, rejecting the glyph
+            itemEncode(locaData, j, writeOffset);
+            startOffset = endOffset;
+            continue;
+          }
+
           var newLength = sanitizeGlyph(oldGlyfData, startOffset, endOffset,
                                         newGlyfData, writeOffset);
           writeOffset += newLength;

test/pdfs/.gitignore

@@ -20,6 +20,7 @@
 !scan-bad.pdf
 !freeculture.pdf
 !issue918.pdf
+!issue1249.pdf
 !smaskdim.pdf
 !type4psfunc.pdf
 !S2.pdf

test/test_manifest.json

@@ -417,6 +417,12 @@
       "link": true,
       "type": "eq"
     },
+    {  "id": "issue1249-load",
+      "file": "pdfs/issue1249.pdf",
+      "md5": "4f81339fa09422a7db980f34ea963609",
+      "rounds": 1,
+      "type": "load"
+    },
     {  "id": "liveprogramming",
       "file": "pdfs/liveprogramming.pdf",
       "md5": "7bd4dad1188232ef597d36fd72c33e52",