moparisthebest/poi
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

61295 -- prevent potential oom in HPSF triggered by fuzzed file

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1802879 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Tim Allison 2017-07-25 01:38:35 +00:00
parent 67719a8d4f
commit df3910135f
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/java/org/apache/poi/hpsf/Vector.java
View File

@ -16,6 +16,9 @@
==================================================================== */
package org.apache.poi.hpsf;
import java.util.ArrayList;
import java.util.List;
import org.apache.poi.util.Internal;
import org.apache.poi.util.LittleEndianByteArrayInputStream;
@ -40,8 +43,11 @@ class Vector {
}
final int length = (int) longLength;
_values = new TypedPropertyValue[length];
//BUG-61295 -- avoid OOM on corrupt file. Build list instead
//of allocating array of length "length".
//If the length is corrupted and crazily big but < Integer.MAX_VALUE,
//this will trigger a RuntimeException "Buffer overrun" in lei.checkPosition
List<TypedPropertyValue> values = new ArrayList<TypedPropertyValue>();
int paddedType = (_type == Variant.VT_VARIANT) ? 0 : _type;
for ( int i = 0; i < length; i++ ) {
TypedPropertyValue value = new TypedPropertyValue(paddedType, null);
@ -50,8 +56,9 @@ class Vector {
} else {
value.readValue(lei);
}
_values[i] = value;
values.add(value);
}
_values = values.toArray(new TypedPropertyValue[values.size()]);
}
TypedPropertyValue[] getValues(){