From 88f091b93e5e97b6d97662196e7b3c0f60b107a3 Mon Sep 17 00:00:00 2001
From: "Amol S. Deshmukh" <amol@apache.org>
Date: Wed, 6 Jul 2005 22:01:13 +0000
Subject: [PATCH] fix for issues 34575 and 35527 { fillFields(..) modified }

git-svn-id: https://svn.apache.org/repos/asf/jakarta/poi/trunk@353739 13f79535-47bb-0310-9956-ffa450edef68
---
 src/java/org/apache/poi/hssf/record/ObjRecord.java | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/java/org/apache/poi/hssf/record/ObjRecord.java b/src/java/org/apache/poi/hssf/record/ObjRecord.java
index a2489be36..486288aab 100644
--- a/src/java/org/apache/poi/hssf/record/ObjRecord.java
+++ b/src/java/org/apache/poi/hssf/record/ObjRecord.java
@@ -92,15 +92,17 @@ public class ObjRecord
     {
         subrecords = new ArrayList();
         int pos = offset;
-        while (pos - offset < size)
+        while (pos - offset <= size-2) // atleast one "short" must be present
         {
             short subRecordSid = LittleEndian.getShort(data, pos);
-            short subRecordSize = LittleEndian.getShort(data, pos + 2);
+            short subRecordSize = -1; // set default to "< 0"
+            if (pos-offset <= size-4) { // see if size info is present, else default to -1
+                subRecordSize = LittleEndian.getShort(data, pos + 2);
+            }
             Record subRecord = SubRecord.createSubRecord(subRecordSid, subRecordSize, data, pos + 4);
             subrecords.add(subRecord);
             pos += subRecord.getRecordSize();
         }
-
     }
 
     public String toString()