From 7c246cb5f0962bae0137c681cb50bcea8867d913 Mon Sep 17 00:00:00 2001 From: Nick Burch Date: Wed, 29 May 2013 17:31:50 +0000 Subject: [PATCH] More on bug #54682 - check for the end offset overflowing too git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1487558 13f79535-47bb-0310-9956-ffa450edef68 --- .../org/apache/poi/hwpf/model/UnhandledDataStructure.java | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java b/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java index 6cf53f746..967f46e80 100644 --- a/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java +++ b/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java @@ -34,10 +34,12 @@ public final class UnhandledDataStructure public UnhandledDataStructure(byte[] buf, int offset, int length) { // Sanity check the size they've asked for - if (offset + length > buf.length) + int offsetEnd = offset + length; + if (offsetEnd > buf.length || offsetEnd < 0) { throw new IndexOutOfBoundsException("Buffer Length is " + buf.length + " " + - "but code is tried to read " + length + " from offset " + offset); + "but code is tried to read " + length + " " + + "from offset " + offset + " to " + offsetEnd); } if (offset < 0 || length < 0) { @@ -46,7 +48,7 @@ public final class UnhandledDataStructure } // Save that requested portion of the data - _buf = Arrays.copyOfRange(buf, offset, offset + length); + _buf = Arrays.copyOfRange(buf, offset, offsetEnd); } byte[] getBuf()