Security contact for reproducible memory-safety issue in Type1 font parsing

[damseleng]

Hello,

I have identified a reproducible memory-safety issue in pdf2json, reachable through the Type1 font parsing code when processing malformed Type1/PFA-style font data.

I would prefer not to disclose the minimized input or detailed sanitizer output publicly before the maintainer has had a chance to review it.

Is there a preferred private security contact, email address, or disclosure route for this project?

I can provide:

• minimized malformed Type1/PFA-style input
• ASan crash log
• affected commit information
• clean-checkout reproduction steps
• a small standalone C++ reproducer using FoFiType1::make() / getName()
• source-level root cause notes
• suggested fix direction

Best regards,
Yukimura