So I am not familiar with the details of CVE-2013-0634, at least I don't recall. But this restriction is the same as adobe_flash_otf_font.rb, is this a mistake or it's actually necessary? We had to force less than 3 chars because the URI sometimes would write to the same memory where we had to control for something else.