moparisthebest/poi
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

61295 -- prevent potential oom in HPSF triggered by fuzzed file

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1802879 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Tim Allison 2017-07-25 01:38:35 +00:00
parent 67719a8d4f
commit df3910135f
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/java/org/apache/poi/hpsf/Vector.java
View File

@ -16,6 +16,9 @@
==================================================================== */ ==================================================================== */
package org.apache.poi.hpsf; package org.apache.poi.hpsf;
import java.util.ArrayList;
import java.util.List;
import org.apache.poi.util.Internal; import org.apache.poi.util.Internal;
import org.apache.poi.util.LittleEndianByteArrayInputStream; import org.apache.poi.util.LittleEndianByteArrayInputStream;
@ -40,8 +43,11 @@ class Vector {
} }
final int length = (int) longLength; final int length = (int) longLength;
_values = new TypedPropertyValue[length]; //BUG-61295 -- avoid OOM on corrupt file. Build list instead
//of allocating array of length "length".
//If the length is corrupted and crazily big but < Integer.MAX_VALUE,
//this will trigger a RuntimeException "Buffer overrun" in lei.checkPosition
List<TypedPropertyValue> values = new ArrayList<TypedPropertyValue>();
int paddedType = (_type == Variant.VT_VARIANT) ? 0 : _type; int paddedType = (_type == Variant.VT_VARIANT) ? 0 : _type;
for ( int i = 0; i < length; i++ ) { for ( int i = 0; i < length; i++ ) {
TypedPropertyValue value = new TypedPropertyValue(paddedType, null); TypedPropertyValue value = new TypedPropertyValue(paddedType, null);
@ -50,8 +56,9 @@ class Vector {
} else { } else {
value.readValue(lei); value.readValue(lei);
} }
_values[i] = value; values.add(value);
} }
_values = values.toArray(new TypedPropertyValue[values.size()]);
} }
TypedPropertyValue[] getValues(){ TypedPropertyValue[] getValues(){