René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Bug]: Type1Font allocates /Subrs array from declared count before validating the body","articleBody":"### Bug summary\n\nThe Type1 font parser trusts the declared `/Subrs` count and allocates a Python list of that size before validating that the following body actually contains that many subroutine definitions. A compact malformed Type1 font can therefore cause avoidable large allocation before parsing fails.\n\n\n### Code for reproduction\n\n```Python\nimport pathlib\nimport resource\nimport tempfile\nimport time\n\nfrom matplotlib._type1font import Type1Font\n\n\ndef main():\n    subrs_count = 5_000_000\n\n    plaintext = (\n        b\"/FontName /LargeSubrsCount def\\n\"\n        b\"/FontBBox [0 0 1 1] def\\n\"\n        + f\"/Subrs {subrs_count} array\\n\".encode(\"ascii\")\n    )\n\n    encrypted_hex = Type1Font._encrypt(plaintext, \"eexec\").hex().encode(\"ascii\")\n    pfa = (\n        b\"%!PS-AdobeFont-1.0: LargeSubrsCount 001.000\\n\"\n        b\"eexec\\n\"\n        + encrypted_hex\n        + b\"\\n\"\n        + (b\"0\" * 512)\n        + b\"\\ncleartomark\\n\"\n    )\n\n    font_path = pathlib.Path(tempfile.mkdtemp()) / \"large-subrs-count.pfa\"\n    font_path.write_bytes(pfa)\n\n    rss_before = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss\n    start = time.time()\n    try:\n        Type1Font(str(font_path))\n    except StopIteration:\n        parse_result = \"body_rejected_after_allocation\"\n    except MemoryError:\n        parse_result = \"memory_error\"\n    else:\n        raise RuntimeError(\"malformed font unexpectedly parsed\")\n\n    elapsed = time.time() - start\n    rss_after = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss\n\n    print(f\"subrs_count={subrs_count}\")\n    print(f\"parse_result={parse_result}\")\n    print(f\"elapsed_seconds={elapsed:.3f}\")\n    print(f\"rss_before_kb={rss_before}\")\n    print(f\"rss_after_kb={rss_after}\")\n    print(f\"rss_delta_kb={rss_after - rss_before}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n### Actual outcome\n\nIn a source-checkout verification run, a compact generated PFA declaring `/Subrs 5000000 array` caused the parser to allocate based on the declared count before the malformed body was rejected:\n\n```text\nsubrs_count=5000000\nparse_result=body_rejected_after_allocation\nelapsed_seconds=0.009\nrss_before_kb=45168\nrss_after_kb=84208\nrss_delta_kb=39040\n```\n\n\n### Expected outcome\n\nMatplotlib should validate the `/Subrs` body structure before allocating a count-sized list, or enforce a reasonable maximum `/Subrs` count before allocation.\n\n### Additional information\n\n\nThe relevant parser path is `lib/matplotlib/_type1font.py`:\n\n```python\ndef _parse_subrs(self, tokens, _data):\n    count_token = next(tokens)\n    ...\n    count = count_token.value()\n    array = [None] * count\n    next(t for t in tokens if t.is_keyword('array'))\n```\n\nThe allocation happens immediately after reading the count token. The parser only confirms the `array` keyword and the following `dup` entries after the list has already been allocated.\n\nThis report is intended as a robustness bug, not as a security vulnerability report. It requires processing an untrusted Type1 PFA/PFB font.\n\n\n### Operating system\n\nLinux\n\n### Matplotlib Version\n\nmain branch source checkout; reproduced on commit `5a33910eb7827d8a6188ff42bc788951c015ff48`; same parser shape was still present on current `main` commit `996f4e877f6a7a50a68e00879183b8db8761461d`.\n\n### Matplotlib Backend\n\nNot backend-specific\n\n### Python version\n\nPython 3.12\n\n### Jupyter version\n\nNot applicable\n\n### Installation\n\ngit checkout","author":{"url":"https://github.com/Str1ckl4nd","@type":"Person","name":"Str1ckl4nd"},"datePublished":"2026-06-27T13:45:49.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/31962/matplotlib/issues/31962"}