{"record":{"id":"f8540a16f3943bb7","repo":"mozilla/pdf.js","slug":"mapbfrangetoarray-ignoring-data-above-max-map-ra","errorCode":null,"errorMessage":"mapBfRangeToArray - ignoring data above MAX_MAP_RANGE.","messagePattern":"mapBfRangeToArray - ignoring data above MAX_MAP_RANGE\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/core/cmap.js","lineNumber":257,"sourceCode":"    while (low <= high) {\n      this._map[low++] = dstLow;\n      // Only the last byte has to be incremented (in the normal case).\n      const nextCharCode = dstLow.charCodeAt(lastByte) + 1;\n      if (nextCharCode > 0xff) {\n        dstLow =\n          dstLow.substring(0, lastByte - 1) +\n          String.fromCharCode(dstLow.charCodeAt(lastByte - 1) + 1) +\n          \"\\x00\";\n        continue;\n      }\n      dstLow =\n        dstLow.substring(0, lastByte) + String.fromCharCode(nextCharCode);\n    }\n  }\n\n  mapBfRangeToArray(low, high, array) {\n    if (high - low > MAX_MAP_RANGE) {\n      throw new Error(\"mapBfRangeToArray - ignoring data above MAX_MAP_RANGE.\");\n    }\n    const ii = array.length;\n    let i = 0;\n    while (low <= high && i < ii) {\n      this._map[low] = array[i++];\n      ++low;\n    }\n  }\n\n  // This is used for both bf and cid chars.\n  mapOne(src, dst) {\n    this._map[src] = dst;\n  }\n\n  lookup(code) {\n    return this._map[code];\n  }\n","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/mozilla/pdf.js/blob/5903d58d58e4dd9ce6ffa3834aea8480f06b4ada/src/core/cmap.js#L239-L275","documentation":"Thrown by CMap.mapBfRangeToArray when the array-form bfrange (beginbfrange ... [ ... ] ... endbfrange) declares a range wider than MAX_MAP_RANGE (2^24 - 1). Same guard as the other map*Range methods but for the array-destination variant where each code maps to a listed entry.","triggerScenarios":"Parsing a CMap where a beginbfrange line uses the [<low> <high> [<d0> <d1> ...]] array form and high - low > 0xFFFFFF.","commonSituations":"Corrupt or hand-crafted ToUnicode CMap using the array bfrange form with an absurdly wide range; malicious PDF.","solutions":["Regenerate the PDF or its ToUnicode stream.","Update pdf.js.","Author CMaps with array-bfrange ranges no wider than 0xFFFFFF.","Catch FormatError/Error and degrade text extraction for that font."],"exampleFix":"// before\nconst cmap = await CMapFactory.create({ encoding, fetchBuiltInCMap, useCMap });\n\n// after\nlet cmap;\ntry {\n  cmap = await CMapFactory.create({ encoding, fetchBuiltInCMap, useCMap });\n} catch (e) {\n  if (/MAX_MAP_RANGE/.test(e.message)) {\n    console.warn('Oversized CMap bf-array range, skipping', e);\n    cmap = null;\n  } else throw e;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  cmap = await CMapFactory.create({ encoding, fetchBuiltInCMap, useCMap });\n} catch (e) {\n  if (/MAX_MAP_RANGE/.test(e.message)) {\n    console.warn('Oversized bf-array range in CMap, skipping', e);\n    cmap = null;\n  } else {\n    throw e;\n  }\n}","preventionTips":["Sanitize untrusted PDFs before rendering.","Keep pdf.js updated.","When authoring array-form bfrange CMaps, keep each range <= 0xFFFFFF.","Validate generated CMaps with a round-trip parse before shipping."],"tags":["cmap","tounicode","font","parsing","memory","pdf"],"backgroundTag":null,"analyzedSha":"5903d58d58e4dd9ce6ffa3834aea8480f06b4ada","analyzedAt":"2026-08-13T02:28:27.364Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}