Author: tallison
Date: Tue Jul 25 20:26:57 2017
New Revision: 1802997
URL: http://svn.apache.org/viewvc?rev=1802997&view=rev
Log:
61338 -- avoid infinite loop triggered by fuzzed wmf file
Added:
poi/trunk/test-data/slideshow/61338.wmf (with props)
Modified:
poi/site/src/documentation/content/xdocs/status.xml
poi/trunk/src/scratchpad/src/org/apache/poi/hwmf/usermodel/HwmfPicture.java
poi/trunk/src/scratchpad/testcases/org/apache/poi/hwmf/TestHwmfParsing.java
Modified: poi/site/src/documentation/content/xdocs/status.xml
URL:
http://svn.apache.org/viewvc/poi/site/src/documentation/content/xdocs/status.xml?rev=1802997&r1=1802996&r2=1802997&view=diff
==============================================================================
--- poi/site/src/documentation/content/xdocs/status.xml (original)
+++ poi/site/src/documentation/content/xdocs/status.xml Tue Jul 25 20:26:57 2017
@@ -58,6 +58,7 @@
<release version="3.17-beta2" date="2017-09-??">
<actions>
+ <action dev="PD" type="fix" fixes-bug="61338" module="HWMF">Avoid
infinite loop with corrupt file.</action>
<action dev="PD" type="fix" fixes-bug="61295" module="HPSF">Avoid OOM
in hpsf with corrupt file.</action>
<action dev="PD" type="add" fixes-bug="61331" module="SL Common">Font
group handling / common font interface</action>
<action dev="PD" type="fix" fixes-bug="61300" module="POIFS">Avoid
infinite loop with corrupt file.</action>
Modified:
poi/trunk/src/scratchpad/src/org/apache/poi/hwmf/usermodel/HwmfPicture.java
URL:
http://svn.apache.org/viewvc/poi/trunk/src/scratchpad/src/org/apache/poi/hwmf/usermodel/HwmfPicture.java?rev=1802997&r1=1802996&r2=1802997&view=diff
==============================================================================
--- poi/trunk/src/scratchpad/src/org/apache/poi/hwmf/usermodel/HwmfPicture.java
(original)
+++ poi/trunk/src/scratchpad/src/org/apache/poi/hwmf/usermodel/HwmfPicture.java
Tue Jul 25 20:26:57 2017
@@ -35,9 +35,11 @@ import org.apache.poi.hwmf.record.HwmfRe
import org.apache.poi.hwmf.record.HwmfRecordType;
import org.apache.poi.hwmf.record.HwmfWindowing.WmfSetWindowExt;
import org.apache.poi.hwmf.record.HwmfWindowing.WmfSetWindowOrg;
+import org.apache.poi.util.IOUtils;
import org.apache.poi.util.LittleEndianInputStream;
import org.apache.poi.util.POILogFactory;
import org.apache.poi.util.POILogger;
+import org.apache.poi.util.RecordFormatException;
import org.apache.poi.util.Units;
public class HwmfPicture {
@@ -59,7 +61,13 @@ public class HwmfPicture {
break;
}
// recordSize in DWORDs
- long recordSize = leis.readUInt()*2;
+ long recordSizeLong = leis.readUInt()*2;
+ if (recordSizeLong > Integer.MAX_VALUE) {
+ throw new RecordFormatException("record size can't be >
"+Integer.MAX_VALUE);
+ } else if (recordSizeLong < 0L) {
+ throw new RecordFormatException("record size can't be < 0");
+ }
+ int recordSize = (int)recordSizeLong;
int recordFunction = leis.readShort();
// 4 bytes (recordSize) + 2 bytes (recordFunction)
int consumedSize = 6;
@@ -82,10 +90,13 @@ public class HwmfPicture {
consumedSize += wr.init(leis, recordSize, recordFunction);
int remainingSize = (int)(recordSize - consumedSize);
- assert(remainingSize >= 0);
- if (remainingSize > 0) {
- // skip size in loops, because not always all bytes are skipped
in one call
- for (int i=remainingSize; i>0; i-=leis.skip(i));
+ if (remainingSize < 0) {
+ throw new RecordFormatException("read too many bytes. record
size: "+recordSize + "; comsumed size: "+consumedSize);
+ } else if(remainingSize > 0) {
+ long skipped = IOUtils.skipFully(leis, remainingSize);
+ if (skipped != (long)remainingSize) {
+ throw new RecordFormatException("Tried to skip
"+remainingSize + " but skipped: "+skipped);
+ }
}
}
}
Modified:
poi/trunk/src/scratchpad/testcases/org/apache/poi/hwmf/TestHwmfParsing.java
URL:
http://svn.apache.org/viewvc/poi/trunk/src/scratchpad/testcases/org/apache/poi/hwmf/TestHwmfParsing.java?rev=1802997&r1=1802996&r2=1802997&view=diff
==============================================================================
--- poi/trunk/src/scratchpad/testcases/org/apache/poi/hwmf/TestHwmfParsing.java
(original)
+++ poi/trunk/src/scratchpad/testcases/org/apache/poi/hwmf/TestHwmfParsing.java
Tue Jul 25 20:26:57 2017
@@ -20,6 +20,7 @@ package org.apache.poi.hwmf;
import static org.apache.poi.POITestCase.assertContains;
import static org.junit.Assert.assertEquals;
+import javax.imageio.ImageIO;
import java.awt.Dimension;
import java.awt.Graphics2D;
import java.awt.RenderingHints;
@@ -38,8 +39,6 @@ import java.util.Locale;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;
-import javax.imageio.ImageIO;
-
import org.apache.poi.POIDataSamples;
import org.apache.poi.hwmf.record.HwmfFill.HwmfImageRecord;
import org.apache.poi.hwmf.record.HwmfFont;
@@ -52,6 +51,7 @@ import org.apache.poi.sl.usermodel.Pictu
import org.apache.poi.sl.usermodel.SlideShow;
import org.apache.poi.sl.usermodel.SlideShowFactory;
import org.apache.poi.util.LocaleUtil;
+import org.apache.poi.util.RecordFormatException;
import org.apache.poi.util.Units;
import org.junit.Ignore;
import org.junit.Test;
@@ -66,7 +66,19 @@ public class TestHwmfParsing {
List<HwmfRecord> records = wmf.getRecords();
assertEquals(581, records.size());
}
-
+
+ @Test(expected = RecordFormatException.class)
+ public void testInfiniteLoop() throws Exception {
+ File f = POIDataSamples.getSlideShowInstance().getFile("61338.wmf");
+ FileInputStream fis = null;
+ try {
+ fis = new FileInputStream(f);
+ HwmfPicture wmf = new HwmfPicture(fis);
+ } finally {
+ fis.close();
+ }
+ }
+
@Test
@Ignore("This is work-in-progress and not a real unit test ...")
public void paint() throws IOException {
Added: poi/trunk/test-data/slideshow/61338.wmf
URL:
http://svn.apache.org/viewvc/poi/trunk/test-data/slideshow/61338.wmf?rev=1802997&view=auto
==============================================================================
Binary file - no diff available.
Propchange: poi/trunk/test-data/slideshow/61338.wmf
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
