#60626 - ArrayIndexOutOfBoundsException in EvilUnclosedBRFixingInputStream

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1782095 13f79535-47bb-0310-9956-ffa450edef68

legal/LICENSE

@@ -511,3 +511,27 @@ SLF4J library (slf4j-api-*.jar)
     LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
     OF CONTRACT, TORT OR OTHERWISE,  ARISING FROM, OUT OF OR IN CONNECTION
     WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+inbot-utils (https://github.com/Inbot/inbot-utils)
+
+	The MIT License (MIT)
+	
+	Copyright (c) 2015 Inbot
+	
+	Permission is hereby granted, free of charge, to any person obtaining a copy
+	of this software and associated documentation files (the "Software"), to deal
+	in the Software without restriction, including without limitation the rights
+	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+	copies of the Software, and to permit persons to whom the Software is
+	furnished to do so, subject to the following conditions:
+	
+	The above copyright notice and this permission notice shall be included in all
+	copies or substantial portions of the Software.
+	
+	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+	SOFTWARE.

src/java/org/apache/poi/util/ReplacingInputStream.java

@@ -0,0 +1,204 @@
+/* ====================================================================
+   Licensed to the Apache Software Foundation (ASF) under one or more
+   contributor license agreements.  See the NOTICE file distributed with
+   this work for additional information regarding copyright ownership.
+   The ASF licenses this file to You under the Apache License, Version 2.0
+   (the "License"); you may not use this file except in compliance with
+   the License.  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+==================================================================== */
+
+package org.apache.poi.util;
+
+import java.io.FilterInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.Charset;
+import java.util.Arrays;
+
+/**
+ * Simple FilterInputStream that can replace occurrences of bytes with something else.
+ *
+ * This has been taken from inbot-utils. (MIT licensed)
+ *
+ * @see <a href="https://github.com/Inbot/inbot-utils">inbot-utils</a>
+ */
+@Internal
+public class ReplacingInputStream extends FilterInputStream {
+
+    // while matching, this is where the bytes go.
+    final int[] buf;
+    private int matchedIndex=0;
+    private int unbufferIndex=0;
+    private int replacedIndex=0;
+
+    private final byte[] pattern;
+    private final byte[] replacement;
+    private State state=State.NOT_MATCHED;
+
+    // simple state machine for keeping track of what we are doing
+    private enum State {
+        NOT_MATCHED,
+        MATCHING,
+        REPLACING,
+        UNBUFFER
+    }
+
+    private static final Charset UTF8 = Charset.forName("UTF-8");
+
+    /**
+     * Replace occurrences of pattern in the input. Note: input is assumed to be UTF-8 encoded. If not the case use byte[] based pattern and replacement.
+     * @param in input
+     * @param pattern pattern to replace.
+     * @param replacement the replacement or null
+     */
+    public ReplacingInputStream(InputStream in, String pattern, String replacement) {
+        this(in, pattern.getBytes(UTF8), replacement==null ? null : replacement.getBytes(UTF8));
+    }
+
+    /**
+     * Replace occurrences of pattern in the input.<p>
+     *
+     * If you want to normalize line endings DOS/MAC (\n\r | \r) to UNIX (\n), you can call the following:<br/>
+     * {@code new ReplacingInputStream(new ReplacingInputStream(is, "\n\r", "\n"), "\r", "\n")}
+     *
+     * @param in input
+     * @param pattern pattern to replace
+     * @param replacement the replacement or null
+     */
+    public ReplacingInputStream(InputStream in, byte[] pattern, byte[] replacement) {
+        super(in);
+        if (pattern == null || pattern.length == 0) {
+            throw new IllegalArgumentException("pattern length should be > 0");
+        }
+        this.pattern = pattern;
+        this.replacement = replacement;
+        // we will never match more than the pattern length
+        buf = new int[pattern.length];
+    }
+
+    @Override
+    public int read(byte[] b, int off, int len) throws IOException {
+        // copy of parent logic; we need to call our own read() instead of super.read(), which delegates instead of calling our read
+        if (b == null) {
+            throw new NullPointerException();
+        } else if (off < 0 || len < 0 || len > b.length - off) {
+            throw new IndexOutOfBoundsException();
+        } else if (len == 0) {
+            return 0;
+        }
+
+        int c = read();
+        if (c == -1) {
+            return -1;
+        }
+        b[off] = (byte)c;
+
+        int i = 1;
+        for (; i < len ; i++) {
+            c = read();
+            if (c == -1) {
+                break;
+            }
+            b[off + i] = (byte)c;
+        }
+        return i;
+
+    }
+
+    @Override
+    public int read(byte[] b) throws IOException {
+        // call our own read
+        return read(b, 0, b.length);
+    }
+
+    @Override
+    public int read() throws IOException {
+        // use a simple state machine to figure out what we are doing
+        int next;
+        switch (state) {
+        default:
+        case NOT_MATCHED:
+            // we are not currently matching, replacing, or unbuffering
+            next=super.read();
+            if (pattern[0] != next) {
+                return next;
+            }
+
+            // clear whatever was there
+            Arrays.fill(buf, 0);
+            // make sure we start at 0
+            matchedIndex=0;
+
+            buf[matchedIndex++]=next;
+            if (pattern.length == 1) {
+                // edge-case when the pattern length is 1 we go straight to replacing
+                state=State.REPLACING;
+                // reset replace counter
+                replacedIndex=0;
+            } else {
+                // pattern of length 1
+                state=State.MATCHING;
+            }
+            // recurse to continue matching
+            return read();
+
+        case MATCHING:
+            // the previous bytes matched part of the pattern
+            next=super.read();
+            if (pattern[matchedIndex]==next) {
+                buf[matchedIndex++]=next;
+                if (matchedIndex==pattern.length) {
+                    // we've found a full match!
+                    if (replacement==null || replacement.length==0) {
+                        // the replacement is empty, go straight to NOT_MATCHED
+                        state=State.NOT_MATCHED;
+                        matchedIndex=0;
+                    } else {
+                        // start replacing
+                        state=State.REPLACING;
+                        replacedIndex=0;
+                    }
+                }
+            } else {
+                // mismatch -> unbuffer
+                buf[matchedIndex++]=next;
+                state=State.UNBUFFER;
+                unbufferIndex=0;
+            }
+            return read();
+
+        case REPLACING:
+            // we've fully matched the pattern and are returning bytes from the replacement
+            next=replacement[replacedIndex++];
+            if (replacedIndex==replacement.length) {
+                state=State.NOT_MATCHED;
+                replacedIndex=0;
+            }
+            return next;
+
+        case UNBUFFER:
+            // we partially matched the pattern before encountering a non matching byte
+            // we need to serve up the buffered bytes before we go back to NOT_MATCHED
+            next=buf[unbufferIndex++];
+            if (unbufferIndex==matchedIndex) {
+                state=State.NOT_MATCHED;
+                matchedIndex=0;
+            }
+            return next;
+        }
+    }
+
+    @Override
+    public String toString() {
+        return state.name() + " " + matchedIndex + " " + replacedIndex + " " + unbufferIndex;
+    }
+
+}

src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java

@@ -34,7 +34,7 @@ import javax.xml.namespace.QName;
 import org.apache.poi.POIXMLDocumentPart;
 import org.apache.poi.openxml4j.opc.PackagePart;
 import org.apache.poi.util.DocumentHelper;
-import org.apache.poi.xssf.util.EvilUnclosedBRFixingInputStream;
+import org.apache.poi.util.ReplacingInputStream;
 import org.apache.xmlbeans.XmlCursor;
 import org.apache.xmlbeans.XmlException;
 import org.apache.xmlbeans.XmlObject;
@@ -124,7 +124,13 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart {
     protected void read(InputStream is) throws IOException, XmlException {
         Document doc;
         try {
-            doc = DocumentHelper.readDocument(new EvilUnclosedBRFixingInputStream(is));
+            /*
+             * This is a seriously sick fix for the fact that some .xlsx files contain raw bits
+             * of HTML, without being escaped or properly turned into XML.
+             * The result is that they contain things like >br<, which breaks the XML parsing.
+             * This very sick InputStream wrapper attempts to spot these go past, and fix them.
+             */
+            doc = DocumentHelper.readDocument(new ReplacingInputStream(is, "<br>", "<br/>"));
         } catch (SAXException e) {
             throw new XmlException(e.getMessage(), e);
         }
@@ -146,7 +152,9 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart {
                 String id = shape.getId();
                 if(id != null) {
                     Matcher m = ptrn_shapeId.matcher(id);
-                    if(m.find()) _shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1)));
+                    if(m.find()) {
+                        _shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1)));
+                    }
                 }
                 _items.add(shape);
             } else {

src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java

@@ -16,9 +16,11 @@
 ==================================================================== */
 package org.apache.poi.xssf.util;
 
-import java.io.IOException;
 import java.io.InputStream;
-import java.util.ArrayList;
+
+import org.apache.poi.util.Internal;
+import org.apache.poi.util.Removal;
+import org.apache.poi.util.ReplacingInputStream;
 
 /**
  * This is a seriously sick fix for the fact that some .xlsx
@@ -31,179 +33,14 @@ import java.util.ArrayList;
  * Only works for UTF-8 and US-ASCII based streams!
  * It should only be used where experience shows the problem
  *  can occur...
+ *  
+ *  @deprecated 3.16-beta2 - use ReplacingInputStream(source, ">br<", ">br/<")
  */
-public class EvilUnclosedBRFixingInputStream extends InputStream {
+@Deprecated
-   private InputStream source;
+@Removal(version="3.18")
-   private byte[] spare;
+@Internal
-   
+public class EvilUnclosedBRFixingInputStream extends ReplacingInputStream {
-   private static byte[] detect = new byte[] {
-      (byte)'<', (byte)'b', (byte)'r', (byte)'>'
-   };
-   
    public EvilUnclosedBRFixingInputStream(InputStream source) {
-      this.source = source;
+      super(source, "<br>", "<br/>");
-   }
-
-   /**
-    * Warning - doesn't fix!
-    */
-   @Override
-   public int read() throws IOException {
-      return source.read();
-   }
-
-   @Override
-   public int read(byte[] b, int off, int len) throws IOException {
-      // Grab any data left from last time
-      int readA = readFromSpare(b, off, len);
-
-      // Now read from the stream 
-      int readB = source.read(b, off+readA, len-readA);
-      
-      // Figure out how much we've done
-      int read;
-      if(readB == -1 || readB == 0) {
-          if (readA == 0) {
-              return readB;
-          }
-         read = readA; 
-      } else {
-         read = readA + readB;
-      }
-      
-      // Fix up our data
-      if(read > 0) {
-         read = fixUp(b, off, read);
-      }
-      
-      // All done
-      return read;
-   }
-
-   @Override
-   public int read(byte[] b) throws IOException {
-      return this.read(b, 0, b.length);
-   }
-   
-   /**
-    * Reads into the buffer from the spare bytes
-    */
-   private int readFromSpare(byte[] b, int offset, int len) {
-      if(spare == null) return 0;
-      if(len == 0) throw new IllegalArgumentException("Asked to read 0 bytes");
-      
-      if(spare.length <= len) {
-         // All fits, good
-         System.arraycopy(spare, 0, b, offset, spare.length);
-         int read = spare.length;
-         spare = null;
-         return read;
-      } else {
-         // We have more spare than they can copy with...
-         byte[] newspare = new byte[spare.length-len];
-         System.arraycopy(spare, 0, b, offset, len);
-         System.arraycopy(spare, len, newspare, 0, newspare.length);
-         spare = newspare;
-         return len;
-      }
-   }
-   private void addToSpare(byte[] b, int offset, int len, boolean atTheEnd) {
-      if(spare == null) {
-         spare = new byte[len];
-         System.arraycopy(b, offset, spare, 0, len);
-      } else {
-         byte[] newspare = new byte[spare.length+len];
-         if(atTheEnd) {
-            System.arraycopy(spare, 0, newspare, 0, spare.length);
-            System.arraycopy(b, offset, newspare, spare.length, len);
-         } else {
-            System.arraycopy(b, offset, newspare, 0, len);
-            System.arraycopy(spare, 0, newspare, len, spare.length);
-         }
-         spare = newspare;
-      }
-   }
-
-   private int fixUp(byte[] b, int offset, int read) {
-      // Do we have any potential overhanging ones?
-      for(int i=0; i<detect.length-1; i++) {
-         int base = offset+read-1-i;
-         if(base < 0) continue;
-            
-         boolean going = true;
-         for(int j=0; j<=i && going; j++) {
-            if(b[base+j] == detect[j]) {
-               // Matches
-            } else {
-               going = false;
-            }
-         }
-         if(going) {
-            // There could be a <br> handing over the end, eg <br|
-            addToSpare(b, base, i+1, true);
-            read -= 1;
-            read -= i;
-            break;
-         }
-      }
-      
-      // Find places to fix
-      ArrayList<Integer> fixAt = new ArrayList<Integer>();
-      for(int i=offset; i<=offset+read-detect.length; i++) {
-         boolean going = true;
-         for(int j=0; j<detect.length && going; j++) {
-            if(b[i+j] != detect[j]) {
-               going = false;
-            }
-         }
-         if(going) {
-            fixAt.add(i);
-         }
-      }
-      
-      if(fixAt.size()==0) {
-         return read;
-      }
-      
-      // If there isn't space in the buffer to contain
-      //  all the fixes, then save the overshoot for next time
-      int needed = offset+read+fixAt.size();
-      int overshoot = needed - b.length;  
-      if(overshoot > 0) {
-         // Make sure we don't loose part of a <br>!
-         int fixes = 0;
-         for(int at : fixAt) {
-            if(at > offset+read-detect.length-overshoot-fixes) {
-               overshoot = needed - at - 1 - fixes;
-               break;
-            }
-            fixes++;
-         }
-
-         addToSpare(b, offset+read-overshoot, overshoot, false);
-         read -= overshoot;
-      }
-      
-      // Fix them, in reverse order so the
-      //  positions are valid
-      for(int j=fixAt.size()-1; j>=0; j--) {
-         int i = fixAt.get(j);
-         if(i >= read+offset) {
-            // This one has moved into the overshoot
-            continue;
-         }
-         if(i > read-3) {
-            // This one has moved into the overshoot
-            continue;
-         }
-
-         byte[] tmp = new byte[read-i-3];
-         System.arraycopy(b, i+3, tmp, 0, tmp.length);
-         b[i+3] = (byte)'/';
-         System.arraycopy(tmp, 0, b, i+4, tmp.length);
-         // It got one longer
-         read++;
-      }
-      return read;
    }
 }

src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java

@@ -16,18 +16,28 @@
 ==================================================================== */
 package org.apache.poi.xssf.usermodel;
 
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
+import java.io.IOException;
 import java.io.InputStream;
 import java.math.BigInteger;
 import java.util.List;
+import java.util.regex.Pattern;
 
-import com.microsoft.schemas.office.excel.STTrueFalseBlank;
 import org.apache.poi.POIDataSamples;
+import org.apache.xmlbeans.XmlException;
 import org.apache.xmlbeans.XmlObject;
+import org.junit.Test;
 
 import com.microsoft.schemas.office.excel.CTClientData;
 import com.microsoft.schemas.office.excel.STObjectType;
+import com.microsoft.schemas.office.excel.STTrueFalseBlank;
 import com.microsoft.schemas.office.office.CTShapeLayout;
 import com.microsoft.schemas.office.office.STConnectType;
 import com.microsoft.schemas.office.office.STInsetMode;
@@ -37,14 +47,10 @@ import com.microsoft.schemas.vml.CTShapetype;
 import com.microsoft.schemas.vml.STExt;
 import com.microsoft.schemas.vml.STTrueFalse;
 
-import junit.framework.TestCase;
+public class TestXSSFVMLDrawing {
 
-/**
+    @Test
- * @author Yegor Kozlov
+    public void testNew() throws IOException, XmlException {
- */
-public class TestXSSFVMLDrawing extends TestCase {
-
-    public void testNew() throws Exception {
         XSSFVMLDrawing vml = new XSSFVMLDrawing();
         List<XmlObject> items = vml.getItems();
         assertEquals(2, items.size());
@@ -57,7 +63,7 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertTrue(items.get(1) instanceof CTShapetype);
         CTShapetype type = (CTShapetype)items.get(1);
         assertEquals("21600,21600", type.getCoordsize());
-        assertEquals(202.0f, type.getSpt());
+        assertEquals(202.0f, type.getSpt(), 0);
         assertEquals("m,l,21600r21600,l21600,xe", type.getPath2());
         assertEquals("_x0000_t202", type.getId());
         assertEquals(STTrueFalse.T, type.getPathArray(0).getGradientshapeok());
@@ -102,7 +108,8 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertTrue(items2.get(2) instanceof CTShape);
     }
 
-    public void testFindCommentShape() throws Exception {
+    @Test
+    public void testFindCommentShape() throws IOException, XmlException {
         
         XSSFVMLDrawing vml = new XSSFVMLDrawing();
         InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml");
@@ -140,7 +147,8 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertSame(sh_a1, newVml.findCommentShape(0, 1));
     }
 
-    public void testRemoveCommentShape() throws Exception {
+    @Test
+    public void testRemoveCommentShape() throws IOException, XmlException {
         XSSFVMLDrawing vml = new XSSFVMLDrawing();
         InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml");
         try {
@@ -156,4 +164,22 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertNull(vml.findCommentShape(0, 0));
 
     }
+    
+    @Test
+    public void testEvilUnclosedBRFixing() throws IOException, XmlException {
+        XSSFVMLDrawing vml = new XSSFVMLDrawing();
+        InputStream stream = POIDataSamples.getOpenXML4JInstance().openResourceAsStream("bug-60626.vml");
+        try {
+            vml.read(stream);
+        } finally {
+            stream.close();
+        }
+        Pattern p = Pattern.compile("<br/>");
+        int count = 0;
+        for (XmlObject xo : vml.getItems()) {
+            String split[] = p.split(xo.toString());
+            count += split.length-1;
+        }
+        assertEquals(16, count);
+    }
 }

src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java

@@ -17,94 +17,78 @@
 
 package org.apache.poi.xssf.util;
 
+import static org.junit.Assert.assertArrayEquals;
+
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.charset.Charset;
 
-import junit.framework.TestCase;
+import org.apache.poi.util.IOUtils;
+import org.apache.poi.util.ReplacingInputStream;
+import org.junit.Test;
 
-public final class TestEvilUnclosedBRFixingInputStream extends TestCase {
+public final class TestEvilUnclosedBRFixingInputStream {
-   public void testOK() throws Exception {
-      byte[] ok = "<p><div>Hello There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
 
-      EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
+    static class EvilUnclosedBRFixingInputStream extends ReplacingInputStream {
-            new ByteArrayInputStream(ok)
+        public EvilUnclosedBRFixingInputStream(byte[] source) {
-      );
+            super(new ByteArrayInputStream(source), "<br>", "<br/>");
+        }
+    }
 
-      ByteArrayOutputStream bout = new ByteArrayOutputStream();
+    @Test
-      boolean going = true;
+    public void testOK() throws IOException {
-      while(going) {
+        byte[] ok = getBytes("<p><div>Hello There!</div> <div>Tags!</div></p>");
-         byte[] b = new byte[1024];
-         int r = inp.read(b);
-         if(r > 0) {
-            bout.write(b, 0, r);
-         } else {
-            going = false;
-         }
-      }
 
-      byte[] result = bout.toByteArray();
+        EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(ok);
-      assertEquals(ok, result);
-   }
 
-   public void testProblem() throws Exception {
+        assertArrayEquals(ok, IOUtils.toByteArray(inp));
-      byte[] orig = "<p><div>Hello<br>There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
+        inp.close();
-      byte[] fixed = "<p><div>Hello<br/>There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
+    }
 
-      EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
+    @Test
-            new ByteArrayInputStream(orig)
+    public void testProblem() throws IOException {
-      );
+        byte[] orig = getBytes("<p><div>Hello<br>There!</div> <div>Tags!</div></p>");
+        byte[] fixed = getBytes("<p><div>Hello<br/>There!</div> <div>Tags!</div></p>");
 
-      ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(orig);
-      boolean going = true;
-      while(going) {
-         byte[] b = new byte[1024];
-         int r = inp.read(b);
-         if(r > 0) {
-            bout.write(b, 0, r);
-         } else {
-            going = false;
-         }
-      }
 
-      byte[] result = bout.toByteArray();
+        assertArrayEquals(fixed, IOUtils.toByteArray(inp));
-      assertEquals(fixed, result);
+        inp.close();
-   }
+    }
 
-   /**
+    /**
-    * Checks that we can copy with br tags around the buffer boundaries
+     * Checks that we can copy with br tags around the buffer boundaries
-    */
+     */
-   public void testBufferSize() throws Exception {
+    @Test
-      byte[] orig = "<p><div>Hello<br> <br>There!</div> <div>Tags!<br><br></div></p>".getBytes("UTF-8");
+    public void testBufferSize() throws IOException {
-      byte[] fixed = "<p><div>Hello<br/> <br/>There!</div> <div>Tags!<br/><br/></div></p>".getBytes("UTF-8");
+        byte[] orig = getBytes("<p><div>Hello<br> <br>There!</div> <div>Tags!<br><br></div></p>");
+        byte[] fixed = getBytes("<p><div>Hello<br/> <br/>There!</div> <div>Tags!<br/><br/></div></p>");
 
-      // Vary the buffer size, so that we can end up with the br in the
+        // Vary the buffer size, so that we can end up with the br in the
-      //  overflow or only part in the buffer
+        //  overflow or only part in the buffer
-      for(int i=5; i<orig.length; i++) {
+        for(int i=5; i<orig.length; i++) {
-         EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
+            EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(orig);
-               new ByteArrayInputStream(orig)
-         );
 
-         ByteArrayOutputStream bout = new ByteArrayOutputStream();
+            ByteArrayOutputStream bout = new ByteArrayOutputStream();
-         boolean going = true;
+            boolean going = true;
-         while(going) {
+            while(going) {
-            byte[] b = new byte[i];
+                byte[] b = new byte[i];
-            int r = inp.read(b);
+                int r = inp.read(b);
-            if(r > 0) {
+                if(r > 0) {
-               bout.write(b, 0, r);
+                    bout.write(b, 0, r);
-            } else {
+                } else {
-               going = false;
+                    going = false;
+                }
             }
-         }
 
-         byte[] result = bout.toByteArray();
+            byte[] result = bout.toByteArray();
-         assertEquals(fixed, result);
+            assertArrayEquals(fixed, result);
-      }
+            inp.close();
-   }
+        }
+    }
 
-   protected void assertEquals(byte[] a, byte[] b) {
+    private static byte[] getBytes(String str) {
-      assertEquals(a.length, b.length);
+        return str.getBytes(Charset.forName("UTF-8"));
-      for(int i=0; i<a.length; i++) {
+    }
-         assertEquals("Wrong byte at index " + i, a[i], b[i]);
-      }
-   }
 }

test-data/openxml4j/bug-60626.vml

@@ -0,0 +1,658 @@
+<xml xmlns:v="urn:schemas-microsoft-com:vml"
+ xmlns:o="urn:schemas-microsoft-com:office:office"
+ xmlns:x="urn:schemas-microsoft-com:office:excel">
+ <o:shapelayout v:ext="edit">
+  <o:idmap v:ext="edit" data="46,98,145,186,227"/>
+ </o:shapelayout><v:shapetype id="_x0000_t201" coordsize="21600,21600" o:spt="201"
+  path="m,l,21600r21600,l21600,xe">
+  <v:stroke joinstyle="miter"/>
+  <v:path shadowok="f" o:extrusionok="f" strokeok="f" fillok="f" o:connecttype="rect"/>
+  <o:lock v:ext="edit" shapetype="t"/>
+ </v:shapetype><v:shape id="_x0000_s47105" type="#_x0000_t201" style='position:absolute;
+  margin-left:15pt;margin-top:323.25pt;width:147.75pt;height:13.5pt;z-index:1;
+  mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <o:lock v:ext="edit" rotation="t" text="t"/>
+  <x:ClientData ObjectType="Drop">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    1, 2, 23, 2, 1, 199, 24, 0</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoLine>False</x:AutoLine>
+   <x:FmlaLink>Risikodaten!$AF$48</x:FmlaLink>
+   <x:Val>0</x:Val>
+   <x:Min>0</x:Min>
+   <x:Max>3</x:Max>
+   <x:Inc>1</x:Inc>
+   <x:Page>1</x:Page>
+   <x:Dx>16</x:Dx>
+   <x:FmlaRange>Risikodaten!$AG$44:$AG$47</x:FmlaRange>
+   <x:Sel>4</x:Sel>
+   <x:NoThreeD2/>
+   <x:SelType>Single</x:SelType>
+   <x:LCT>Normal</x:LCT>
+   <x:DropStyle>Combo</x:DropStyle>
+   <x:DropLines>8</x:DropLines>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s47106" type="#_x0000_t201" style='position:absolute;
+  margin-left:971.25pt;margin-top:203.25pt;width:21pt;height:17.25pt;z-index:2;
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 14, 15, 2, 21, 1, 16, 5</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:FmlaLink>$U$16</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s47123" type="#_x0000_t201" style='position:absolute;
+  margin-left:971.25pt;margin-top:147.75pt;width:17.25pt;height:16.5pt;
+  z-index:3;mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 14, 11, 0, 20, 37, 12, 4</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!E16</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s47124" type="#_x0000_t201" style='position:absolute;
+  margin-left:15pt;margin-top:336.75pt;width:147.75pt;height:14.25pt;z-index:4;
+  mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t" text="t"/>
+  <x:ClientData ObjectType="Drop">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    1, 2, 24, 0, 1, 199, 24, 19</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoLine>False</x:AutoLine>
+   <x:FmlaLink>Antrag!$Y$65</x:FmlaLink>
+   <x:Val>0</x:Val>
+   <x:Min>0</x:Min>
+   <x:Max>1</x:Max>
+   <x:Inc>1</x:Inc>
+   <x:Page>1</x:Page>
+   <x:Dx>16</x:Dx>
+   <x:FmlaRange>Antrag!$Z$63:$Z$64</x:FmlaRange>
+   <x:Sel>2</x:Sel>
+   <x:NoThreeD2/>
+   <x:SelType>Single</x:SelType>
+   <x:LCT>Normal</x:LCT>
+   <x:DropStyle>Combo</x:DropStyle>
+   <x:DropLines>8</x:DropLines>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s100534" type="#_x0000_t201" style='position:absolute;
+  margin-left:994.5pt;margin-top:102pt;width:121.5pt;height:15.75pt;z-index:5'
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <o:lock v:ext="edit" rotation="t" text="t"/>
+  <x:ClientData ObjectType="Drop">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    21, 4, 7, 11, 23, 28, 8, 14</x:Anchor>
+   <x:AutoLine>False</x:AutoLine>
+   <x:FmlaLink>Risikodaten!$AF$22</x:FmlaLink>
+   <x:Val>0</x:Val>
+   <x:Min>0</x:Min>
+   <x:Max>0</x:Max>
+   <x:Inc>1</x:Inc>
+   <x:Page>3</x:Page>
+   <x:Dx>16</x:Dx>
+   <x:FmlaRange>Risikodaten!$AG$19:$AG$21</x:FmlaRange>
+   <x:Sel>2</x:Sel>
+   <x:NoThreeD2/>
+   <x:SelType>Single</x:SelType>
+   <x:LCT>Normal</x:LCT>
+   <x:DropStyle>Combo</x:DropStyle>
+   <x:DropLines>8</x:DropLines>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s100535" type="#_x0000_t201" style='position:absolute;
+  margin-left:971.25pt;margin-top:177pt;width:15pt;height:11.25pt;z-index:6;
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 14, 13, 3, 20, 34, 14, 0</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!$J$13</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s100536" type="#_x0000_t201" style='position:absolute;
+  margin-left:971.25pt;margin-top:190.5pt;width:15pt;height:11.25pt;z-index:7;
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 14, 14, 3, 20, 34, 15, 0</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:FmlaLink>Risikodaten!$J$14</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s100537" type="#_x0000_t201" style='position:absolute;
+  margin-left:971.25pt;margin-top:163.5pt;width:15pt;height:11.25pt;z-index:8;
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 14, 12, 3, 20, 34, 13, 0</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!$J$12</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s100539" type="#_x0000_t201" style='position:absolute;
+  margin-left:971.25pt;margin-top:122.25pt;width:15pt;height:11.25pt;z-index:9;
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 14, 9, 2, 20, 34, 9, 17</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:FmlaLink>Risikodaten!$J$9</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s100760" type="#_x0000_t201" style='position:absolute;
+  margin-left:1255.5pt;margin-top:336.75pt;width:15.75pt;height:11.25pt;
+  z-index:10;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    25, 70, 24, 0, 26, 19, 24, 15</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:FmlaLink>Risikodaten!$AD$8</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="ComboBox1" o:spid="_x0000_s149031" type="#_x0000_t201"
+  style='position:absolute;margin-left:1190.25pt;margin-top:6.75pt;width:173.25pt;
+  height:28.5pt;z-index:11;mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]"
+  o:insetmode="auto">
+  <v:imagedata o:relid="rId1" o:title=""/>
+  <x:ClientData ObjectType="Pict">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    24, 55, 0, 9, 27, 70, 2, 13</x:Anchor>
+   <x:AutoLine>False</x:AutoLine>
+   <x:FmlaLink>Vermittler!$B$2</x:FmlaLink>
+   <x:FmlaRange>Vermittler!$M$6:$N$206</x:FmlaRange>
+   <x:CF>Pict</x:CF>
+   <x:AutoPict/>
+   <x:MapOCX/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149207" type="#_x0000_t201" style='position:absolute;
+  margin-left:439.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:12;
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    9, 12, 25, 9, 9, 88, 25, 25</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_Allianz</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149208" type="#_x0000_t201" style='position:absolute;
+  margin-left:354pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:13;
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    7, 12, 25, 9, 7, 88, 25, 25</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_Generali</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149209" type="#_x0000_t201" style='position:absolute;
+  margin-left:269.25pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:14;
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    5, 13, 25, 9, 5, 89, 25, 25</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_Donau</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149210" type="#_x0000_t201" style='position:absolute;
+  margin-left:524.25pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:15;
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    11, 11, 25, 9, 11, 87, 25, 25</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_AragSE</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149211" type="#_x0000_t201" style='position:absolute;
+  margin-left:610.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:16;
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    13, 12, 25, 9, 13, 88, 25, 25</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_HDI</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149212" type="#_x0000_t201" style='position:absolute;
+  margin-left:696pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:17;
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    15, 12, 25, 9, 15, 88, 25, 25</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_Zürich</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149213" type="#_x0000_t201" style='position:absolute;
+  margin-left:781.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:18;
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    17, 12, 25, 9, 17, 88, 25, 25</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_Uniqa</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s149258" type="#_x0000_t201" style='position:absolute;
+  margin-left:182.25pt;margin-top:354.75pt;width:55.5pt;height:11.25pt;
+  z-index:19;visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:center'><font face="Calibri" size="200"
+   color="#800000"><b>Ausblenden<br>
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>
+      </b></font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Button">
+   <x:Anchor>
+    3, 11, 25, 4, 3, 85, 25, 19</x:Anchor>
+   <x:PrintObject>False</x:PrintObject>
+   <x:AutoFill>False</x:AutoFill>
+   <x:FmlaMacro>[0]!Ausblenden_VU_bisher</x:FmlaMacro>
+   <x:TextHAlign>Center</x:TextHAlign>
+   <x:TextVAlign>Center</x:TextVAlign>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191175" type="#_x0000_t201" style='position:absolute;
+  margin-left:993pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;z-index:20;
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
+  strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    21, 2, 19, 14, 22, 2, 20, 11</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!Y20</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191176" type="#_x0000_t201" style='position:absolute;
+  margin-left:1042.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
+  z-index:21;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    22, 2, 19, 14, 22, 68, 20, 11</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!Z20</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191177" type="#_x0000_t201" style='position:absolute;
+  margin-left:1096.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
+  z-index:22;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    23, 2, 19, 14, 23, 68, 20, 11</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!AA20</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191178" type="#_x0000_t201" style='position:absolute;
+  margin-left:1150.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
+  z-index:23;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    24, 2, 19, 14, 24, 68, 20, 11</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!AB20</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191179" type="#_x0000_t201" style='position:absolute;
+  margin-left:1204.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
+  z-index:24;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    25, 2, 19, 14, 25, 68, 20, 11</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!AC20</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191180" type="#_x0000_t201" style='position:absolute;
+  margin-left:1258.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
+  z-index:25;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    26, 2, 19, 14, 26, 68, 20, 11</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!AD20</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191181" type="#_x0000_t201" style='position:absolute;
+  margin-left:1312.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
+  z-index:26;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    27, 2, 19, 14, 27, 68, 20, 11</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!AE20</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191430" type="#_x0000_t201" style='position:absolute;
+  margin-left:970.5pt;margin-top:13.5pt;width:15pt;height:10.5pt;z-index:27;
+  mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill o:detectmouseclick="t"/>
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 13, 1, 1, 20, 33, 1, 15</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!$I$8</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191431" type="#_x0000_t201" style='position:absolute;
+  margin-left:970.5pt;margin-top:26.25pt;width:15pt;height:11.25pt;z-index:28;
+  mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill o:detectmouseclick="t"/>
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 13, 2, 1, 20, 33, 2, 16</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:Checked>1</x:Checked>
+   <x:FmlaLink>Risikodaten!$I22</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shape id="_x0000_s191432" type="#_x0000_t201" style='position:absolute;
+  margin-left:970.5pt;margin-top:39pt;width:15pt;height:11.25pt;z-index:29;
+  mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
+  <v:fill o:detectmouseclick="t"/>
+  <v:path shadowok="t" strokeok="t" fillok="t"/>
+  <o:lock v:ext="edit" rotation="t"/>
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">
+   <div style='text-align:left'></div>
+  </v:textbox>
+  <x:ClientData ObjectType="Checkbox">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    20, 13, 3, 1, 20, 33, 3, 16</x:Anchor>
+   <x:AutoFill>False</x:AutoFill>
+   <x:AutoLine>False</x:AutoLine>
+   <x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>
+   <x:TextVAlign>Center</x:TextVAlign>
+   <x:FmlaLink>Risikodaten!$I$29</x:FmlaLink>
+   <x:NoThreeD/>
+  </x:ClientData>
+ </v:shape><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75"
+  o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
+  <v:stroke joinstyle="miter"/>
+  <v:formulas>
+   <v:f eqn="if lineDrawn pixelLineWidth 0"/>
+   <v:f eqn="sum @0 1 0"/>
+   <v:f eqn="sum 0 0 @1"/>
+   <v:f eqn="prod @2 1 2"/>
+   <v:f eqn="prod @3 21600 pixelWidth"/>
+   <v:f eqn="prod @3 21600 pixelHeight"/>
+   <v:f eqn="sum @0 0 1"/>
+   <v:f eqn="prod @6 1 2"/>
+   <v:f eqn="prod @7 21600 pixelWidth"/>
+   <v:f eqn="sum @8 21600 0"/>
+   <v:f eqn="prod @7 21600 pixelHeight"/>
+   <v:f eqn="sum @10 21600 0"/>
+  </v:formulas>
+  <v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
+  <o:lock v:ext="edit" aspectratio="t"/>
+ </v:shapetype><v:shape id="Grafik_x0020_5" o:spid="_x0000_s232729" type="#_x0000_t75"
+  style='position:absolute;margin-left:14.25pt;margin-top:73.5pt;width:604.5pt;
+  height:102.75pt;z-index:30;visibility:visible;mso-wrap-style:square'
+  filled="t" fillcolor="white [9]" stroked="t" strokecolor="windowText [64]">
+  <v:imagedata o:relid="rId2" o:title=""/>
+  <x:ClientData ObjectType="Pict">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    1, 1, 5, 9, 13, 23, 13, 2</x:Anchor>
+   <x:FmlaPict>Antrag!$B$7:$K$13</x:FmlaPict>
+   <x:CF>Pict</x:CF>
+   <x:Camera/>
+  </x:ClientData>
+ </v:shape><v:shape id="Grafik_x0020_24" o:spid="_x0000_s232730" type="#_x0000_t75"
+  style='position:absolute;margin-left:15pt;margin-top:.75pt;width:603.75pt;
+  height:45pt;z-index:31;visibility:visible;mso-wrap-style:square'
+  o:preferrelative="f" filled="t" fillcolor="white [9]" stroked="t"
+  strokecolor="windowText [64]">
+  <v:imagedata o:relid="rId3" o:title=""/>
+  <o:lock v:ext="edit" aspectratio="f"/>
+  <x:ClientData ObjectType="Pict">
+   <x:SizeWithCells/>
+   <x:Anchor>
+    1, 2, 0, 1, 13, 23, 3, 10</x:Anchor>
+   <x:FmlaPict>$DO$1:$DZ$3</x:FmlaPict>
+   <x:CF>Pict</x:CF>
+   <x:Camera/>
+  </x:ClientData>
+ </v:shape></xml>