Tilman Hausherr

I get `spring-security-core-5.1.5.RELEASE.jar (cpe:/a:pivotal_software:spring_security:5.1.5, org.springframework.security:spring-security-core:5.1.5.RELEASE) : CVE-2018-1258` despite using spring 5.1.6.RELEASE and spring security 5.1.5.RELEASE.

It's a JDK bug: https://bugs.openjdk.java.net/browse/JDK-8251928

Yes, after creating the issue I realized that it is probably futile. But the other extension brings a warning that it has not been evaluated by Mozilla.

Why did you change the equals and the hash, is this for optimizing? (Assumption that xform is only scale, never shear) I tried the scale change from your last commit,...

I can't remember that said that but I see I wrote it in the issue. And yes it's true 😂. I just had to create a PDF a week ago...

Thanks, I committed everything except the memory leak. The problem is that I don't know for sure if the object is still used. The tests pass, but we don't really...

@lehmi any opinion on this, i.e. does the "on demand" parsing logic also apply to FDF / XFDF, so that the input should not be closed until done?

@lehmi Thank you. @valerybokov I committed the FDF part, but used the interface type on the left side of the assignment, see [here](https://stackoverflow.com/questions/19611908/) why (although not really important here)

Thanks, I think we're done here. If yes, then please close the PR.

Thanks, this looks promising. However `sb.setLength(0);` won't work because it's the same object that is assigned to `radix`.