https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

header31012 +
    format31012
  );
}
function validateOS2Table(os2, file) {
  file.pos = (file.start || 0) + os2.offset;
  const version = file.getUint16();
  
  
  file.skip(60); 
  const selection = file.getUint16();
  if (version < 4 && selection & 0x0300) {
    return false;
  }
  const firstChar = file.getUint16();
  const lastChar = file.getUint16();
  if (firstChar > lastChar) {
    return false;
  }
  file.skip(6); 
  const usWinAscent = file.getUint16();
  if (usWinAscent === 0) {
    
    return false;
  }
  
  os2.data[8] = os2.data[9] = 0; 
  return true;
}
function createOS2Table(properties, charstrings, override) {