Fix #44824 - Avoid an infinite loop when reading some HWPF pictures

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@658287 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Nick Burch 2008-05-20 15:46:54 +00:00
parent 74f90acf81
commit 1747a02fa7
3 changed files with 3 additions and 0 deletions

View File

@ -37,6 +37,7 @@
<!-- Don't forget to update status.xml too! --> <!-- Don't forget to update status.xml too! -->
<release version="3.1-final" date="2008-06-??"> <release version="3.1-final" date="2008-06-??">
<action dev="POI-DEVELOPERS" type="fix">44824 - Avoid an infinite loop when reading some HWPF pictures</action>
<action dev="POI-DEVELOPERS" type="fix">44898 - Correctly handle short last blocks in POIFS</action> <action dev="POI-DEVELOPERS" type="fix">44898 - Correctly handle short last blocks in POIFS</action>
</release> </release>
<release version="3.1-beta2" date="2008-05-26"> <release version="3.1-beta2" date="2008-05-26">

View File

@ -34,6 +34,7 @@
<!-- Don't forget to update changes.xml too! --> <!-- Don't forget to update changes.xml too! -->
<changes> <changes>
<release version="3.1-final" date="2008-06-??"> <release version="3.1-final" date="2008-06-??">
<action dev="POI-DEVELOPERS" type="fix">44824 - Avoid an infinite loop when reading some HWPF pictures</action>
<action dev="POI-DEVELOPERS" type="fix">44898 - Correctly handle short last blocks in POIFS</action> <action dev="POI-DEVELOPERS" type="fix">44898 - Correctly handle short last blocks in POIFS</action>
</release> </release>
<release version="3.1-beta2" date="2008-05-26"> <release version="3.1-beta2" date="2008-05-26">

View File

@ -363,6 +363,7 @@ public class Picture
do { do {
firstByte = _dataStream[pointer]; firstByte = _dataStream[pointer];
secondByte = _dataStream[pointer+1]; secondByte = _dataStream[pointer+1];
pointer += 2;
} while (!(firstByte==(byte)0xFF) && pointer<endOfPicture-1); } while (!(firstByte==(byte)0xFF) && pointer<endOfPicture-1);
if (firstByte==((byte)0xFF) && pointer<endOfPicture-1) { if (firstByte==((byte)0xFF) && pointer<endOfPicture-1) {