Program: 61885
Project: 61885
Buggy source:
/** 
 * Constructor
 * @param swf
 * @param data Data bytes
 * @param version SWF version
 * @param pos
 * @throws IOException
 */
public DefineFont2Tag(SWF swf,byte[] data,int version,long pos) throws IOException {
  super(swf,ID,"String_Node_Str",data,pos);
  SWFInputStream sis=new SWFInputStream(new ByteArrayInputStream(data),version);
  fontId=sis.readUI16();
  fontFlagsHasLayout=sis.readUB(1) == 1;
  fontFlagsShiftJIS=sis.readUB(1) == 1;
  fontFlagsSmallText=sis.readUB(1) == 1;
  fontFlagsANSI=sis.readUB(1) == 1;
  fontFlagsWideOffsets=sis.readUB(1) == 1;
  fontFlagsWideCodes=sis.readUB(1) == 1;
  fontFlagsItalic=sis.readUB(1) == 1;
  fontFlagsBold=sis.readUB(1) == 1;
  languageCode=sis.readLANGCODE();
  int fontNameLen=sis.readUI8();
  fontName=new String(sis.readBytesEx(fontNameLen));
  numGlyphs=sis.readUI16();
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideOffsets) {
      sis.readUI32();
    }
 else {
      sis.readUI16();
    }
  }
  if (numGlyphs > 0) {
    if (fontFlagsWideOffsets) {
      sis.readUI32();
    }
 else {
      sis.readUI16();
    }
  }
  glyphShapeTable=new ArrayList<>();
  for (int i=0; i < numGlyphs; i++) {
    glyphShapeTable.add(sis.readSHAPE(1));
  }
  codeTable=new ArrayList<>();
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideCodes) {
      codeTable.add(sis.readUI16());
    }
 else {
      codeTable.add(sis.readUI8());
    }
  }
  if (fontFlagsHasLayout) {
    fontAscent=sis.readSI16();
    fontDescent=sis.readSI16();
    fontLeading=sis.readSI16();
    fontAdvanceTable=new ArrayList<>();
    for (int i=0; i < numGlyphs; i++) {
      fontAdvanceTable.add(sis.readSI16());
    }
    fontBoundsTable=new ArrayList<>();
    for (int i=0; i < numGlyphs; i++) {
      fontBoundsTable.add(sis.readRECT());
    }
    int kerningCount=sis.readUI16();
    fontKerningTable=new KERNINGRECORD[kerningCount];
    for (int i=0; i < kerningCount; i++) {
      fontKerningTable[i]=sis.readKERNINGRECORD(fontFlagsWideCodes);
    }
  }
}

Fixed version (ground truth):
/** 
 * Constructor
 * @param swf
 * @param data Data bytes
 * @param version SWF version
 * @param pos
 * @throws IOException
 */
public DefineFont2Tag(SWF swf,byte[] data,int version,long pos) throws IOException {
  super(swf,ID,"String_Node_Str",data,pos);
  SWFInputStream sis=new SWFInputStream(new ByteArrayInputStream(data),version);
  fontId=sis.readUI16();
  fontFlagsHasLayout=sis.readUB(1) == 1;
  fontFlagsShiftJIS=sis.readUB(1) == 1;
  fontFlagsSmallText=sis.readUB(1) == 1;
  fontFlagsANSI=sis.readUB(1) == 1;
  fontFlagsWideOffsets=sis.readUB(1) == 1;
  fontFlagsWideCodes=sis.readUB(1) == 1;
  fontFlagsItalic=sis.readUB(1) == 1;
  fontFlagsBold=sis.readUB(1) == 1;
  languageCode=sis.readLANGCODE();
  int fontNameLen=sis.readUI8();
  if (version >= 6) {
    fontName=new String(sis.readBytesEx(fontNameLen),Utf8Helper.charset);
  }
 else {
    fontName=new String(sis.readBytesEx(fontNameLen));
  }
  numGlyphs=sis.readUI16();
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideOffsets) {
      sis.readUI32();
    }
 else {
      sis.readUI16();
    }
  }
  if (numGlyphs > 0) {
    if (fontFlagsWideOffsets) {
      sis.readUI32();
    }
 else {
      sis.readUI16();
    }
  }
  glyphShapeTable=new ArrayList<>();
  for (int i=0; i < numGlyphs; i++) {
    glyphShapeTable.add(sis.readSHAPE(1));
  }
  codeTable=new ArrayList<>();
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideCodes) {
      codeTable.add(sis.readUI16());
    }
 else {
      codeTable.add(sis.readUI8());
    }
  }
  if (fontFlagsHasLayout) {
    fontAscent=sis.readSI16();
    fontDescent=sis.readSI16();
    fontLeading=sis.readSI16();
    fontAdvanceTable=new ArrayList<>();
    for (int i=0; i < numGlyphs; i++) {
      fontAdvanceTable.add(sis.readSI16());
    }
    fontBoundsTable=new ArrayList<>();
    for (int i=0; i < numGlyphs; i++) {
      fontBoundsTable.add(sis.readRECT());
    }
    int kerningCount=sis.readUI16();
    fontKerningTable=new KERNINGRECORD[kerningCount];
    for (int i=0; i < kerningCount; i++) {
      fontKerningTable[i]=sis.readKERNINGRECORD(fontFlagsWideCodes);
    }
  }
}