Program: 62160
Project: 62160
Buggy source:
/** 
 * Constructor
 * @param data Data bytes
 * @param version SWF version
 * @throws IOException
 */
public DefineFont2Tag(byte data[],int version,long pos) throws IOException {
  super(48,"String_Node_Str",data,pos);
  SWFInputStream sis=new SWFInputStream(new ByteArrayInputStream(data),version);
  fontId=sis.readUI16();
  fontFlagsHasLayout=sis.readUB(1) == 1;
  fontFlagsShiftJIS=sis.readUB(1) == 1;
  fontFlagsSmallText=sis.readUB(1) == 1;
  fontFlagsANSI=sis.readUB(1) == 1;
  fontFlagsWideOffsets=sis.readUB(1) == 1;
  fontFlagsWideCodes=sis.readUB(1) == 1;
  fontFlagsItalic=sis.readUB(1) == 1;
  fontFlagsBold=sis.readUB(1) == 1;
  languageCode=sis.readLANGCODE();
  int fontNameLen=sis.readUI8();
  fontName=new String(sis.readBytes(fontNameLen));
  numGlyphs=sis.readUI16();
  offsetTable=new long[numGlyphs];
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideOffsets) {
      offsetTable[i]=sis.readUI32();
    }
 else {
      offsetTable[i]=sis.readUI16();
    }
  }
  long codeTableOffset;
  if (fontFlagsWideOffsets) {
    codeTableOffset=sis.readUI32();
  }
 else {
    codeTableOffset=sis.readUI16();
  }
  glyphShapeTable=new SHAPE[numGlyphs];
  for (int i=0; i < numGlyphs; i++) {
    glyphShapeTable[i]=sis.readSHAPE(1);
  }
  codeTable=new ArrayList<>();
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideCodes) {
      codeTable.add(sis.readUI16());
    }
 else {
      codeTable.add(sis.readUI8());
    }
  }
  if (fontFlagsHasLayout) {
    fontAscent=sis.readSI16();
    fontDescent=sis.readSI16();
    fontLeading=sis.readSI16();
    fontAdvanceTable=new int[numGlyphs];
    for (int i=0; i < numGlyphs; i++) {
      fontAdvanceTable[i]=sis.readSI16();
    }
    fontBoundsTable=new RECT[numGlyphs];
    for (int i=0; i < numGlyphs; i++) {
      fontBoundsTable[i]=sis.readRECT();
    }
    int kerningCount=sis.readUI16();
    fontKerningTable=new KERNINGRECORD[kerningCount];
    for (int i=0; i < kerningCount; i++) {
      fontKerningTable[i]=sis.readKERNINGRECORD(fontFlagsWideCodes);
    }
  }
}

Fixed version (ground truth):
/** 
 * Constructor
 * @param data Data bytes
 * @param version SWF version
 * @throws IOException
 */
public DefineFont2Tag(byte data[],int version,long pos) throws IOException {
  super(48,"String_Node_Str",data,pos);
  SWFInputStream sis=new SWFInputStream(new ByteArrayInputStream(data),version);
  fontId=sis.readUI16();
  fontFlagsHasLayout=sis.readUB(1) == 1;
  fontFlagsShiftJIS=sis.readUB(1) == 1;
  fontFlagsSmallText=sis.readUB(1) == 1;
  fontFlagsANSI=sis.readUB(1) == 1;
  fontFlagsWideOffsets=sis.readUB(1) == 1;
  fontFlagsWideCodes=sis.readUB(1) == 1;
  fontFlagsItalic=sis.readUB(1) == 1;
  fontFlagsBold=sis.readUB(1) == 1;
  languageCode=sis.readLANGCODE();
  int fontNameLen=sis.readUI8();
  fontName=new String(sis.readBytes(fontNameLen));
  numGlyphs=sis.readUI16();
  offsetTable=new long[numGlyphs];
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideOffsets) {
      offsetTable[i]=sis.readUI32();
    }
 else {
      offsetTable[i]=sis.readUI16();
    }
  }
  long codeTableOffset=0;
  if (numGlyphs > 0) {
    if (fontFlagsWideOffsets) {
      codeTableOffset=sis.readUI32();
    }
 else {
      codeTableOffset=sis.readUI16();
    }
  }
  glyphShapeTable=new SHAPE[numGlyphs];
  for (int i=0; i < numGlyphs; i++) {
    glyphShapeTable[i]=sis.readSHAPE(1);
  }
  codeTable=new ArrayList<>();
  for (int i=0; i < numGlyphs; i++) {
    if (fontFlagsWideCodes) {
      codeTable.add(sis.readUI16());
    }
 else {
      codeTable.add(sis.readUI8());
    }
  }
  if (fontFlagsHasLayout) {
    fontAscent=sis.readSI16();
    fontDescent=sis.readSI16();
    fontLeading=sis.readSI16();
    fontAdvanceTable=new int[numGlyphs];
    for (int i=0; i < numGlyphs; i++) {
      fontAdvanceTable[i]=sis.readSI16();
    }
    fontBoundsTable=new RECT[numGlyphs];
    for (int i=0; i < numGlyphs; i++) {
      fontBoundsTable[i]=sis.readRECT();
    }
    int kerningCount=sis.readUI16();
    fontKerningTable=new KERNINGRECORD[kerningCount];
    for (int i=0; i < kerningCount; i++) {
      fontKerningTable[i]=sis.readKERNINGRECORD(fontFlagsWideCodes);
    }
  }
}