From 1747a02fa7ac75c49326ecbdc2c6caca9e56b8bc Mon Sep 17 00:00:00 2001
From: Nick Burch <nick@apache.org>
Date: Tue, 20 May 2008 15:46:54 +0000
Subject: [PATCH] Fix #44824 - Avoid an infinite loop when reading some HWPF
 pictures

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@658287 13f79535-47bb-0310-9956-ffa450edef68
---
 src/documentation/content/xdocs/changes.xml                   | 1 +
 src/documentation/content/xdocs/status.xml                    | 1 +
 src/scratchpad/src/org/apache/poi/hwpf/usermodel/Picture.java | 1 +
 3 files changed, 3 insertions(+)

diff --git a/src/documentation/content/xdocs/changes.xml b/src/documentation/content/xdocs/changes.xml
index b9ed583d5..421404a94 100644
--- a/src/documentation/content/xdocs/changes.xml
+++ b/src/documentation/content/xdocs/changes.xml
@@ -37,6 +37,7 @@
 
 		<!-- Don't forget to update status.xml too! -->
         <release version="3.1-final" date="2008-06-??">
+           <action dev="POI-DEVELOPERS" type="fix">44824 - Avoid an infinite loop when reading some HWPF pictures</action>
            <action dev="POI-DEVELOPERS" type="fix">44898 - Correctly handle short last blocks in POIFS</action>
         </release>  
         <release version="3.1-beta2" date="2008-05-26">
diff --git a/src/documentation/content/xdocs/status.xml b/src/documentation/content/xdocs/status.xml
index aea0a9f1a..da781461e 100644
--- a/src/documentation/content/xdocs/status.xml
+++ b/src/documentation/content/xdocs/status.xml
@@ -34,6 +34,7 @@
 	<!-- Don't forget to update changes.xml too! -->
     <changes>
         <release version="3.1-final" date="2008-06-??">
+           <action dev="POI-DEVELOPERS" type="fix">44824 - Avoid an infinite loop when reading some HWPF pictures</action>
            <action dev="POI-DEVELOPERS" type="fix">44898 - Correctly handle short last blocks in POIFS</action>
         </release>  
         <release version="3.1-beta2" date="2008-05-26">
diff --git a/src/scratchpad/src/org/apache/poi/hwpf/usermodel/Picture.java b/src/scratchpad/src/org/apache/poi/hwpf/usermodel/Picture.java
index e9ee228c1..473a9331b 100644
--- a/src/scratchpad/src/org/apache/poi/hwpf/usermodel/Picture.java
+++ b/src/scratchpad/src/org/apache/poi/hwpf/usermodel/Picture.java
@@ -363,6 +363,7 @@ public class Picture
       do {
         firstByte = _dataStream[pointer];
         secondByte = _dataStream[pointer+1];
+        pointer += 2;
       } while (!(firstByte==(byte)0xFF) && pointer<endOfPicture-1);
 
       if (firstByte==((byte)0xFF) && pointer<endOfPicture-1) {