{"record":{"id":"c16a702efc52369d","repo":"mozilla/pdf.js","slug":"mapbfrange-ignoring-data-above-max-map-range","errorCode":null,"errorMessage":"mapBfRange - ignoring data above MAX_MAP_RANGE.","messagePattern":"mapBfRange - ignoring data above MAX_MAP_RANGE\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/core/cmap.js","lineNumber":236,"sourceCode":"  }\n\n  addCodespaceRange(n, low, high) {\n    this.codespaceRanges[n - 1].push(low, high);\n    this.numCodespaceRanges++;\n  }\n\n  mapCidRange(low, high, dstLow) {\n    if (high - low > MAX_MAP_RANGE) {\n      throw new Error(\"mapCidRange - ignoring data above MAX_MAP_RANGE.\");\n    }\n    while (low <= high) {\n      this._map[low++] = dstLow++;\n    }\n  }\n\n  mapBfRange(low, high, dstLow) {\n    if (high - low > MAX_MAP_RANGE) {\n      throw new Error(\"mapBfRange - ignoring data above MAX_MAP_RANGE.\");\n    }\n    const lastByte = dstLow.length - 1;\n    while (low <= high) {\n      this._map[low++] = dstLow;\n      // Only the last byte has to be incremented (in the normal case).\n      const nextCharCode = dstLow.charCodeAt(lastByte) + 1;\n      if (nextCharCode > 0xff) {\n        dstLow =\n          dstLow.substring(0, lastByte - 1) +\n          String.fromCharCode(dstLow.charCodeAt(lastByte - 1) + 1) +\n          \"\\x00\";\n        continue;\n      }\n      dstLow =\n        dstLow.substring(0, lastByte) + String.fromCharCode(nextCharCode);\n    }\n  }\n","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/mozilla/pdf.js/blob/5903d58d58e4dd9ce6ffa3834aea8480f06b4ada/src/core/cmap.js#L218-L254","documentation":"Thrown by CMap.mapBfRange when a beginbfrange entry spans more than MAX_MAP_RANGE (2^24 - 1) code points. Same memory guard as mapCidRange but for the string-destination bf range form used in ToUnicode CMaps. Indicates a malformed or hostile ToUnicode stream.","triggerScenarios":"Parsing a CMap whose beginbfrange ... endbfrange block contains <low> <high> <dst-string> where high - low > 0xFFFFFF. Hit while building a font's ToUnicode mapping for text search/selection/copy.","commonSituations":"Corrupt ToUnicode CMap emitted by a broken PDF writer; malicious PDF designed to balloon memory; truncated CMap reassembled incorrectly.","solutions":["Repair or regenerate the PDF; an authoritative reader should also reject it.","Update pdf.js for stricter/safer CMap handling.","Split the offending bfrange into multiple ranges each <= 0xFFFFFF wide if you author CMaps.","Catch the error and continue without ToUnicode (text selection accuracy degrades but rendering works)."],"exampleFix":"// before\nconst cmap = await CMapFactory.create({ encoding, fetchBuiltInCMap, useCMap });\n\n// after\nlet cmap;\ntry {\n  cmap = await CMapFactory.create({ encoding, fetchBuiltInCMap, useCMap });\n} catch (e) {\n  if (/MAX_MAP_RANGE/.test(e.message)) {\n    console.warn('Oversized CMap bf range, skipping', e);\n    cmap = null;\n  } else throw e;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  cmap = await CMapFactory.create({ encoding, fetchBuiltInCMap, useCMap });\n} catch (e) {\n  if (/MAX_MAP_RANGE/.test(e.message)) {\n    console.warn('Oversized bf range in CMap, skipping', e);\n    cmap = null;\n  } else {\n    throw e;\n  }\n}","preventionTips":["Sanitize untrusted PDFs before rendering.","Keep pdf.js updated.","When generating ToUnicode CMaps, keep each bfrange <= 0xFFFFFF.","Treat any single-range CMap wider than 16M as a defect in your PDF pipeline."],"tags":["cmap","tounicode","font","parsing","memory","pdf"],"backgroundTag":null,"analyzedSha":"5903d58d58e4dd9ce6ffa3834aea8480f06b4ada","analyzedAt":"2026-08-13T02:28:27.364Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}