This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new cbe698731a Guard Ole10Native readUtf16 byte length against int
overflow (#1080)
cbe698731a is described below
commit cbe698731a5e2da2d20c1116e2be161747e8b398
Author: jmestwa-coder <[email protected]>
AuthorDate: Wed May 27 21:18:30 2026 +0530
Guard Ole10Native readUtf16 byte length against int overflow (#1080)
* Guard Ole10Native readUtf16 byte length against int overflow
* Use POITestCase assertContains in Ole10Native overflow test
---
.../org/apache/poi/poifs/filesystem/Ole10Native.java | 2 +-
.../apache/poi/poifs/filesystem/TestOle10Native.java | 20 ++++++++++++++++++++
2 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/poi/src/main/java/org/apache/poi/poifs/filesystem/Ole10Native.java
b/poi/src/main/java/org/apache/poi/poifs/filesystem/Ole10Native.java
index fef85f82db..027500dcb5 100644
--- a/poi/src/main/java/org/apache/poi/poifs/filesystem/Ole10Native.java
+++ b/poi/src/main/java/org/apache/poi/poifs/filesystem/Ole10Native.java
@@ -290,7 +290,7 @@ public class Ole10Native {
private static String readUtf16(LittleEndianByteArrayInputStream leis)
throws IOException {
int size = leis.readInt();
- byte[] buf = IOUtils.toByteArray(leis, size * 2, MAX_STRING_LENGTH);
+ byte[] buf = IOUtils.toByteArray(leis, size * 2L, MAX_STRING_LENGTH);
return StringUtil.getFromUnicodeLE(buf, 0, size);
}
diff --git
a/poi/src/test/java/org/apache/poi/poifs/filesystem/TestOle10Native.java
b/poi/src/test/java/org/apache/poi/poifs/filesystem/TestOle10Native.java
index dfe5867946..86d4ad7db1 100644
--- a/poi/src/test/java/org/apache/poi/poifs/filesystem/TestOle10Native.java
+++ b/poi/src/test/java/org/apache/poi/poifs/filesystem/TestOle10Native.java
@@ -33,6 +33,7 @@ import java.util.List;
import org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream;
import org.apache.poi.POIDataSamples;
import org.apache.poi.util.IOUtils;
+import org.apache.poi.util.LittleEndian;
import org.apache.poi.util.RecordFormatException;
import org.junit.jupiter.api.Test;
@@ -107,4 +108,23 @@ class TestOle10Native {
}
}
+ @Test
+ void testOle10NativeUtf16SizeOverflow() {
+ // command2 declares 0x40000001 UTF-16 chars; the byte count (size *
2) overflows
+ // a signed int to a negative value that slips past the
MAX_STRING_LENGTH cap.
+ byte[] data = new byte[34];
+ LittleEndian.putShort(data, 4, (short) 2); // flags1 -> parsed
encoding
+ data[6] = 'A'; // label (AsciiZ)
+ data[8] = 'B'; // fileName (AsciiZ)
+ // flags2, unknown1, ascii command length and data length stay zero
+ LittleEndian.putInt(data, 22, 0x40000001); // command2 char count
+ LittleEndian.putInt(data, 0, data.length - 4); // totalSize
+
+ RecordFormatException ex = assertThrows(
+ RecordFormatException.class,
+ () -> new Ole10Native(data, 0)
+ );
+ assertContains(ex.getMessage(), "Tried to allocate");
+ }
+
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
