moparisthebest/poi
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Fix bug #54682 - UnhandledDataStructure should sanity check before allocating, not after

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1487555 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Nick Burch 2013-05-29 17:25:40 +00:00
parent 8044d82dd5
commit c702bc5ce5
1 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java
View File

@ -17,8 +17,15 @@
package org.apache.poi.hwpf.model; package org.apache.poi.hwpf.model;
import java.util.Arrays;
import org.apache.poi.util.Internal; import org.apache.poi.util.Internal;
/**
* A data structure used to hold some data we don't
* understand / can't handle, so we have it available
* for when we come to write back out again
*/
@Internal @Internal
public final class UnhandledDataStructure public final class UnhandledDataStructure
{ {
@ -26,14 +33,20 @@ public final class UnhandledDataStructure
public UnhandledDataStructure(byte[] buf, int offset, int length) public UnhandledDataStructure(byte[] buf, int offset, int length)
{ {
// System.out.println("Yes, using my code"); // Sanity check the size they've asked for
_buf = new byte[length];
if (offset + length > buf.length) if (offset + length > buf.length)
{ {
throw new IndexOutOfBoundsException("buffer length is " + buf.length + throw new IndexOutOfBoundsException("Buffer Length is " + buf.length + " " +
"but code is trying to read " + length + " from offset " + offset); "but code is tried to read " + length + " from offset " + offset);
} }
System.arraycopy(buf, offset, _buf, 0, length); if (offset < 0 || length < 0)
{
throw new IndexOutOfBoundsException("Offset and Length must both be >= 0, negative " +
"indicies are not permitted - code is tried to read " + length + " from offset " + offset);
}
// Save that requested portion of the data
_buf = Arrays.copyOfRange(buf, offset, offset + length);
} }
byte[] getBuf() byte[] getBuf()