moparisthebest/poi
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Sanity check the length, logging and truncating if too long, to avoid a StringIndexOutOfBoundsException (bug #54925)

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1496520 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Nick Burch 2013-06-25 15:49:45 +00:00
parent 456f6171d9
commit 84a00d8d4b
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/scratchpad/src/org/apache/poi/hslf/record/StyleTextPropAtom.java
View File

@ -273,6 +273,7 @@ public final class StyleTextPropAtom extends RecordAtom
while(pos < rawContents.length && textHandled < prsize) {
// First up, fetch the number of characters this applies to
int textLen = LittleEndian.getInt(rawContents,pos);
textLen = checkTextLength(textLen, textHandled, size);
textHandled += textLen;
pos += 4;
@ -308,6 +309,7 @@ public final class StyleTextPropAtom extends RecordAtom
while(pos < rawContents.length && textHandled < chsize) {
// First up, fetch the number of characters this applies to
int textLen = LittleEndian.getInt(rawContents,pos);
textLen = checkTextLength(textLen, textHandled, size);
textHandled += textLen;
pos += 4;
@ -345,6 +347,15 @@ public final class StyleTextPropAtom extends RecordAtom
initialised = true;
}
private int checkTextLength(int readLength, int handledSoFar, int overallSize) {
if (readLength + handledSoFar > overallSize + 1) {
logger.log(POILogger.WARN, "Style length of " + readLength + " at " + handledSoFar +
" larger than stated size of " + overallSize + ", truncating");
return overallSize + 1 - handledSoFar;
}
return readLength;
}
/**