https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

const tag = file.getString(4);
      const checksum = file.getInt32() >>> 0;
      const offset = file.getInt32() >>> 0;
      const length = file.getInt32() >>> 0;
      
      const previousPosition = file.pos;
      file.pos = file.start ? file.start : 0;
      file.skip(offset);
      const data = file.getBytes(length);
      file.pos = previousPosition;
      if (tag === "head") {
        
        data[8] = data[9] = data[10] = data[11] = 0;
        data[17] |= 0x20; 
      }
      return {
        tag,
        checksum,
        length,
        offset,
        data,
      };
    }
    function readOpenTypeHeader(ttf) {