This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new 2344a81268 more int overflow risks (#1101)
2344a81268 is described below
commit 2344a81268b111aeb29c3e35188238643c2f7122
Author: PJ Fanning <[email protected]>
AuthorDate: Mon Jun 1 22:51:10 2026 +0100
more int overflow risks (#1101)
* more int overflow risks
* some reverts due to test issues
* try to fix skip issues
* Update poi-integration-exceptions.csv
---
.../org/apache/poi/xslf/usermodel/XSLFPictureShape.java | 5 ++++-
.../org/apache/poi/xssf/model/ExternalLinksTable.java | 2 +-
.../src/main/java/org/apache/poi/xssf/model/MapInfo.java | 4 ++--
.../java/org/apache/poi/xssf/streaming/SXSSFSheet.java | 3 ++-
.../java/org/apache/poi/xssf/usermodel/XSSFCellStyle.java | 9 +++++----
.../java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java | 15 +++++++++------
.../main/java/org/apache/poi/xwpf/usermodel/XWPFRun.java | 2 +-
.../java/org/apache/poi/hemf/draw/HemfImageRenderer.java | 6 +++++-
.../java/org/apache/poi/hemf/record/emf/HemfComment.java | 2 +-
.../java/org/apache/poi/hemf/record/emf/HemfHeader.java | 4 ++--
.../apache/poi/hemf/record/emf/HemfRecordIterator.java | 2 +-
.../java/org/apache/poi/hpbf/model/QuillContents.java | 4 ++--
.../src/main/java/org/apache/poi/hslf/blip/Bitmap.java | 5 +++--
.../src/main/java/org/apache/poi/hslf/dev/PPTXMLDump.java | 10 +++++-----
.../org/apache/poi/hslf/dev/SlideShowRecordDumper.java | 2 +-
.../main/java/org/apache/poi/hslf/record/SlideAtom.java | 2 +-
.../java/org/apache/poi/util/LittleEndianInputStream.java | 11 +++++++++++
test-data/poi-integration-exceptions.csv | 2 +-
18 files changed, 57 insertions(+), 33 deletions(-)
diff --git
a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureShape.java
b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureShape.java
index aec5faccf6..b429a22ad2 100644
---
a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureShape.java
+++
b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureShape.java
@@ -45,6 +45,7 @@ import org.apache.poi.sl.usermodel.PictureData.PictureType;
import org.apache.poi.sl.usermodel.PictureShape;
import org.apache.poi.sl.usermodel.Placeholder;
import org.apache.poi.util.Beta;
+import org.apache.poi.util.MathUtil;
import org.apache.poi.util.Units;
import org.apache.poi.xslf.draw.SVGImageRenderer;
import org.apache.xmlbeans.XmlCursor;
@@ -372,7 +373,9 @@ public class XSLFPictureShape extends XSLFSimpleShape
Dimension2D dim = renderer.getDimension();
Rectangle2D anc = (anchor != null) ? anchor
- : new Rectangle2D.Double(0,0,
Units.pixelToPoints((int)dim.getWidth()),
Units.pixelToPoints((int)dim.getHeight()));
+ : new Rectangle2D.Double(0,0,
+ Units.pixelToPoints(MathUtil.safeDoubleToInt(dim.getWidth())),
+
Units.pixelToPoints(MathUtil.safeDoubleToInt(dim.getHeight())));
PictureType pt = (previewType != null) ? previewType : PictureType.PNG;
if (pt != PictureType.JPEG && pt != PictureType.GIF && pt !=
PictureType.PNG) {
diff --git
a/poi-ooxml/src/main/java/org/apache/poi/xssf/model/ExternalLinksTable.java
b/poi-ooxml/src/main/java/org/apache/poi/xssf/model/ExternalLinksTable.java
index 89b2b87e29..37bc7f2872 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xssf/model/ExternalLinksTable.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/model/ExternalLinksTable.java
@@ -257,7 +257,7 @@ public class ExternalLinksTable extends POIXMLDocumentPart {
@Override
public int getSheetIndex() {
if (name.isSetSheetId()) {
- return (int)name.getSheetId();
+ return Math.toIntExact(name.getSheetId());
}
return -1;
}
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/model/MapInfo.java
b/poi-ooxml/src/main/java/org/apache/poi/xssf/model/MapInfo.java
index 46eee39c36..20bde4c85a 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xssf/model/MapInfo.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/model/MapInfo.java
@@ -75,7 +75,7 @@ public class MapInfo extends POIXMLDocumentPart {
maps= new HashMap<>();
for(CTMap map :mapInfo.getMapArray()){
- maps.put((int)map.getID(), new XSSFMap(map,this));
+ maps.put(Math.toIntExact(map.getID()), new XSSFMap(map,this));
}
} catch (XmlException e) {
@@ -127,7 +127,7 @@ public class MapInfo extends POIXMLDocumentPart {
XSSFMap matchedMap = null;
- for(XSSFMap map :maps.values()){
+ for(XSSFMap map : maps.values()){
if(map.getCtMap().getName()!=null &&
map.getCtMap().getName().equals(name)){
matchedMap = map;
}
diff --git
a/poi-ooxml/src/main/java/org/apache/poi/xssf/streaming/SXSSFSheet.java
b/poi-ooxml/src/main/java/org/apache/poi/xssf/streaming/SXSSFSheet.java
index 9ac5399f45..b86f935025 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xssf/streaming/SXSSFSheet.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/streaming/SXSSFSheet.java
@@ -30,6 +30,7 @@ import org.apache.poi.ss.util.CellRangeAddress;
import org.apache.poi.ss.util.PaneInformation;
import org.apache.poi.ss.util.SheetUtil;
import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
import org.apache.poi.util.NotImplemented;
import org.apache.poi.util.Removal;
import org.apache.poi.xssf.usermodel.*;
@@ -1667,7 +1668,7 @@ public class SXSSFSheet implements Sheet,
OoxmlSheetExtensions {
// get the best-fit width of rows currently in the random access window
final double w1 = SheetUtil.getColumnWidth(this, column,
useMergedCells);
- final int activeWidth = (int) ((256 * w1) + getArbitraryExtraWidth());
+ final int activeWidth = MathUtil.safeDoubleToInt((256 * w1) +
getArbitraryExtraWidth());
// the best-fit width for both flushed rows and random access window
rows
// flushedWidth or activeWidth may be negative if column contains only
blank cells
diff --git
a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFCellStyle.java
b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFCellStyle.java
index 9261589152..5a0ddfbbc3 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFCellStyle.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFCellStyle.java
@@ -34,6 +34,7 @@ import org.apache.poi.ss.usermodel.ReadingOrder;
import org.apache.poi.ss.usermodel.VerticalAlignment;
import org.apache.poi.ss.util.CellUtil;
import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
import org.apache.poi.xssf.model.StylesTable;
import org.apache.poi.xssf.model.ThemesTable;
import org.apache.poi.xssf.usermodel.extensions.XSSFCellAlignment;
@@ -369,7 +370,7 @@ public class XSSFCellStyle implements CellStyle,
Duplicatable {
// bug 56295: handle missing applyFill attribute as "true" because
Excel does as well
if(_cellXf.isSetApplyFill() && !_cellXf.getApplyFill()) return null;
- int fillIndex = (int)_cellXf.getFillId();
+ int fillIndex = Math.toIntExact(_cellXf.getFillId());
XSSFCellFill fg = _stylesSource.getFillAt(fillIndex);
XSSFColor fillBackgroundColor = fg.getFillBackgroundColor();
@@ -408,7 +409,7 @@ public class XSSFCellStyle implements CellStyle,
Duplicatable {
// bug 56295: handle missing applyFill attribute as "true" because
Excel does as well
if(_cellXf.isSetApplyFill() && !_cellXf.getApplyFill()) return null;
- int fillIndex = (int)_cellXf.getFillId();
+ int fillIndex = Math.toIntExact(_cellXf.getFillId());
XSSFCellFill fg = _stylesSource.getFillAt(fillIndex);
XSSFColor fillForegroundColor = fg.getFillForegroundColor();
@@ -423,7 +424,7 @@ public class XSSFCellStyle implements CellStyle,
Duplicatable {
// bug 56295: handle missing applyFill attribute as "true" because
Excel does as well
if(_cellXf.isSetApplyFill() && !_cellXf.getApplyFill()) return
FillPatternType.NO_FILL;
- int fillIndex = (int)_cellXf.getFillId();
+ int fillIndex = MathUtil.safeDoubleToInt(_cellXf.getFillId());
XSSFCellFill fill = _stylesSource.getFillAt(fillIndex);
STPatternType.Enum ptrn = fill.getPatternType();
@@ -935,7 +936,7 @@ public class XSSFCellStyle implements CellStyle,
Duplicatable {
CTFill ct;
// bug 56295: handle missing applyFill attribute as "true" because
Excel does as well
if(!_cellXf.isSetApplyFill() || _cellXf.getApplyFill()) {
- int fillIndex = (int)_cellXf.getFillId();
+ int fillIndex = MathUtil.safeDoubleToInt(_cellXf.getFillId());
XSSFCellFill cf = _stylesSource.getFillAt(fillIndex);
ct = (CTFill)cf.getCTFill().copy();
diff --git
a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java
b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java
index 680fe2433d..62c81e1e81 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java
@@ -25,6 +25,7 @@ import java.util.function.Function;
import org.apache.poi.ooxml.POIXMLDocumentPart;
import org.apache.poi.ooxml.util.POIXMLUnits;
import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
import org.apache.poi.util.Units;
import org.apache.poi.wp.usermodel.Paragraph;
import org.apache.xmlbeans.XmlCursor;
@@ -932,7 +933,8 @@ public class XWPFParagraph implements IBodyElement,
IRunBody, ISDTContents, Para
*/
public int getSpacingAfter() {
CTSpacing spacing = getCTSpacing(false);
- return (spacing != null && spacing.isSetAfter()) ?
(int)Units.toDXA(POIXMLUnits.parseLength(spacing.xgetAfter())) : -1;
+ return (spacing != null && spacing.isSetAfter()) ?
+
MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(spacing.xgetAfter())))
: -1;
}
/**
@@ -998,7 +1000,8 @@ public class XWPFParagraph implements IBodyElement,
IRunBody, ISDTContents, Para
*/
public int getSpacingBefore() {
CTSpacing spacing = getCTSpacing(false);
- return (spacing != null && spacing.isSetBefore()) ?
(int)Units.toDXA(POIXMLUnits.parseLength(spacing.xgetBefore())) : -1;
+ return (spacing != null && spacing.isSetBefore()) ?
+
MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(spacing.xgetBefore())))
: -1;
}
/**
@@ -1146,7 +1149,7 @@ public class XWPFParagraph implements IBodyElement,
IRunBody, ISDTContents, Para
public int getIndentationLeft() {
CTInd indentation = getCTInd(false);
return (indentation != null && indentation.isSetLeft())
- ? (int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetLeft()))
+ ?
MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetLeft())))
: -1;
}
@@ -1212,7 +1215,7 @@ public class XWPFParagraph implements IBodyElement,
IRunBody, ISDTContents, Para
public int getIndentationRight() {
CTInd indentation = getCTInd(false);
return (indentation != null && indentation.isSetRight())
- ?
(int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetRight()))
+ ?
MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetRight())))
: -1;
}
@@ -1277,7 +1280,7 @@ public class XWPFParagraph implements IBodyElement,
IRunBody, ISDTContents, Para
public int getIndentationHanging() {
CTInd indentation = getCTInd(false);
return (indentation != null && indentation.isSetHanging())
- ?
(int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetHanging())) : -1;
+ ?
MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetHanging())))
: -1;
}
/**
@@ -1318,7 +1321,7 @@ public class XWPFParagraph implements IBodyElement,
IRunBody, ISDTContents, Para
public int getIndentationFirstLine() {
CTInd indentation = getCTInd(false);
return (indentation != null && indentation.isSetFirstLine())
- ?
(int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetFirstLine()))
+ ?
MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetFirstLine())))
: -1;
}
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFRun.java
b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFRun.java
index 687c518162..9fc06c8c00 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFRun.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFRun.java
@@ -807,7 +807,7 @@ public class XWPFRun implements ISDTContents, IRunElement,
CharacterRun {
if (pr == null || pr.sizeOfKernArray() == 0) {
return 0;
}
- return (int)POIXMLUnits.parseLength(pr.getKernArray(0).xgetVal());
+ return
Math.toIntExact(POIXMLUnits.parseLength(pr.getKernArray(0).xgetVal()));
}
@Override
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/draw/HemfImageRenderer.java
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/draw/HemfImageRenderer.java
index 27efbe18a9..cf348154f0 100644
---
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/draw/HemfImageRenderer.java
+++
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/draw/HemfImageRenderer.java
@@ -39,6 +39,7 @@ import org.apache.poi.sl.draw.Drawable;
import org.apache.poi.sl.draw.EmbeddedExtractor;
import org.apache.poi.sl.draw.ImageRenderer;
import org.apache.poi.sl.usermodel.PictureData;
+import org.apache.poi.util.MathUtil;
import org.apache.poi.util.Units;
@SuppressWarnings("unused")
@@ -84,7 +85,10 @@ public class HemfImageRenderer implements ImageRenderer,
EmbeddedExtractor {
return new BufferedImage(1, 1, BufferedImage.TYPE_INT_ARGB);
}
- BufferedImage bufImg = new BufferedImage((int)dim.getWidth(),
(int)dim.getHeight(), BufferedImage.TYPE_INT_ARGB);
+ BufferedImage bufImg = new BufferedImage(
+ MathUtil.safeDoubleToInt(dim.getWidth()),
+ MathUtil.safeDoubleToInt(dim.getHeight()),
+ BufferedImage.TYPE_INT_ARGB);
Graphics2D g = bufImg.createGraphics();
g.setRenderingHint(RenderingHints.KEY_ANTIALIASING,
RenderingHints.VALUE_ANTIALIAS_ON);
g.setRenderingHint(RenderingHints.KEY_RENDERING,
RenderingHints.VALUE_RENDER_QUALITY);
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfComment.java
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfComment.java
index ff9d0f48a9..2aeaa3716c 100644
---
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfComment.java
+++
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfComment.java
@@ -247,7 +247,7 @@ public class HemfComment {
final EmfCommentData record = commentType.constructor.get();
long readBytes = record.init(leis, dataSize);
- final int skipBytes = Math.toIntExact(recordSize-4-readBytes);
+ final long skipBytes = recordSize-4-readBytes;
assert (skipBytes >= 0);
leis.skipFully(skipBytes);
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfHeader.java
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfHeader.java
index 01b43d613f..3ecb2eed84 100644
---
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfHeader.java
+++
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfHeader.java
@@ -175,8 +175,8 @@ public class HemfHeader implements HemfRecord {
}
int maxDescriptionLength = Math.toIntExact(Math.min(recordSize,
Integer.MAX_VALUE));
IOUtils.safelyAllocateCheck(descriptionBytes,
maxDescriptionLength);
- leis.mark((int)(skip + descriptionBytes));
- leis.skipFully((int)skip);
+ leis.mark(Math.toIntExact(skip + descriptionBytes));
+ leis.skipFully(skip);
byte[] buf = IOUtils.safelyAllocate(descriptionBytes,
maxDescriptionLength);
leis.readFully(buf);
description = new String(buf,
StandardCharsets.UTF_16LE).replace((char)0, ' ').trim();
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfRecordIterator.java
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfRecordIterator.java
index 64b4d176ef..dc2ca7118f 100644
---
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfRecordIterator.java
+++
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfRecordIterator.java
@@ -81,7 +81,7 @@ public class HemfRecordIterator implements
Iterator<HemfRecord> {
if (readBytes > remBytes) {
throw new RecordFormatException("Record limit exceeded -
readBytes: "+readBytes+" / remBytes: "+remBytes);
}
- stream.skipFully((int) (remBytes - readBytes));
+ stream.skipFully(remBytes - readBytes);
} catch (RecordFormatException e) {
throw e;
} catch (IOException|RuntimeException e) {
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hpbf/model/QuillContents.java
b/poi-scratchpad/src/main/java/org/apache/poi/hpbf/model/QuillContents.java
index fdc1bd3010..ee7aac0aee 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hpbf/model/QuillContents.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hpbf/model/QuillContents.java
@@ -79,8 +79,8 @@ public final class QuillContents extends HPBFPart {
"QuillContents bit offset " + fromU + " exceeds
Integer.MAX_VALUE");
}
IOUtils.safelyAllocateCheck(lenU,
EscherPart.getMaxRecordLength());
- int from = (int)fromU;
- int len = (int)lenU;
+ int from = Math.toIntExact(fromU);
+ int len = Math.toIntExact(lenU);
byte[] bitData = IOUtils.safelyClone(data, from, len,
EscherPart.getMaxRecordLength());
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/blip/Bitmap.java
b/poi-scratchpad/src/main/java/org/apache/poi/hslf/blip/Bitmap.java
index 6e489c7012..e143e5e040 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/blip/Bitmap.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/blip/Bitmap.java
@@ -31,6 +31,7 @@ import org.apache.poi.hslf.record.RecordAtom;
import org.apache.poi.hslf.usermodel.HSLFPictureData;
import org.apache.poi.util.IOUtils;
import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
import org.apache.poi.util.Units;
/**
@@ -98,8 +99,8 @@ public abstract class Bitmap extends HSLFPictureData {
try (InputStream is =
UnsynchronizedByteArrayInputStream.builder().setByteArray(getData()).get()){
BufferedImage bi = ImageIO.read(is);
return new Dimension(
- (int)Units.pixelToPoints(bi.getWidth()),
- (int)Units.pixelToPoints(bi.getHeight())
+
MathUtil.safeDoubleToInt(Units.pixelToPoints(bi.getWidth())),
+
MathUtil.safeDoubleToInt(Units.pixelToPoints(bi.getHeight()))
);
} catch (IOException e) {
return new Dimension(200,200);
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/PPTXMLDump.java
b/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/PPTXMLDump.java
index 96e3292b66..784a815b70 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/PPTXMLDump.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/PPTXMLDump.java
@@ -121,10 +121,10 @@ public final class PPTXMLDump {
pos += LittleEndianConsts.SHORT_SIZE;
int type = LittleEndian.getUShort(data, pos);
pos += LittleEndianConsts.SHORT_SIZE;
- int size = (int)LittleEndian.getUInt(data, pos);
+ long size = LittleEndian.getUInt(data, pos);
pos += LittleEndianConsts.INT_SIZE;
- if (size < 0) {
+ if (size < 0 || size > Integer.MAX_VALUE) {
// stop processing of invalid header data
continue;
}
@@ -143,15 +143,15 @@ public final class PPTXMLDump {
boolean isContainer = (info & 0x000F) == 0x000F;
if (isContainer) {
//continue to dump child records
- dump(data, pos, size, padding);
+ dump(data, pos, Math.toIntExact(size), padding);
} else {
//dump first 100 bytes of the atom data
- dump(out, data, pos, Math.min(size, data.length-pos), padding,
true);
+ dump(out, data, pos, Math.toIntExact(Math.min(size,
data.length-pos)), padding, true);
}
padding--;
write(out, "</"+recname + ">" + CR, padding);
- pos += size;
+ pos += Math.toIntExact(size);
}
}
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/SlideShowRecordDumper.java
b/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/SlideShowRecordDumper.java
index 30242ba081..18d9494475 100644
---
a/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/SlideShowRecordDumper.java
+++
b/poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/SlideShowRecordDumper.java
@@ -235,7 +235,7 @@ public final class SlideShowRecordDumper {
int len = getDiskLen(r);
// Grab the type as hex
- String hexType = makeHex((int) r.getRecordType(), 4);
+ String hexType = makeHex(Math.toIntExact(r.getRecordType()), 4);
String rHexType = reverseHex(hexType);
// Grab the hslf.record type
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/SlideAtom.java
b/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/SlideAtom.java
index 42fa25e1c9..72b612d384 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/SlideAtom.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/SlideAtom.java
@@ -109,7 +109,7 @@ public final class SlideAtom extends RecordAtom {
public SlideAtom(){
_header = new byte[8];
LittleEndian.putUShort(_header, 0, 2);
- LittleEndian.putUShort(_header, 2, (int)_type);
+ LittleEndian.putUShort(_header, 2, Math.toIntExact(_type));
LittleEndian.putInt(_header, 4, 24);
byte[] ssdate = new byte[12];
diff --git a/poi/src/main/java/org/apache/poi/util/LittleEndianInputStream.java
b/poi/src/main/java/org/apache/poi/util/LittleEndianInputStream.java
index cc2c3b927f..204a5aa5f2 100644
--- a/poi/src/main/java/org/apache/poi/util/LittleEndianInputStream.java
+++ b/poi/src/main/java/org/apache/poi/util/LittleEndianInputStream.java
@@ -216,4 +216,15 @@ public class LittleEndianInputStream extends
FilterInputStream implements Little
}
checkEOF((int)skipped, len);
}
+
+ public void skipFully(long len) throws IOException {
+ if (len == 0) {
+ return;
+ }
+ long skipped = IOUtils.skipFully(this, len);
+ if (skipped > Integer.MAX_VALUE) {
+ throw new IOException("can't skip further than
"+Integer.MAX_VALUE);
+ }
+ checkEOF((int)skipped, (int)len);
+ }
}
diff --git a/test-data/poi-integration-exceptions.csv
b/test-data/poi-integration-exceptions.csv
index 9244a0337b..f38fec98ff 100644
--- a/test-data/poi-integration-exceptions.csv
+++ b/test-data/poi-integration-exceptions.csv
@@ -375,7 +375,7 @@
spreadsheet/rde.imf.ru_sites_default_files_rde_documents_vodootvedenie_2020.xlsb
spreadsheet/crash-e329fca9087fe21bca4a80c8bc472a661c98d860.xls,handle,HSSF,,org.apache.poi.util.RecordFormatException,33198
bytes written but getRecordSize() reports 33194,
slideshow/61338.wmf,"handle,extract",HWMF,,org.apache.poi.util.RecordFormatException,Tried
to skip 9699347 but skipped: 489,
slideshow/file-45.wmf,handle,HWMF,,org.apache.poi.util.RecordFormatException,The
width or height specified in the header exceed the current limit,
-spreadsheet/61294.emf,"handle,extract",HEMF,,org.apache.poi.util.RecordFormatException,java.lang.IllegalArgumentException:
Skip count must be non-negative,
+spreadsheet/61294.emf,"handle,extract",HEMF,,org.apache.poi.util.RecordFormatException,java.lang.IllegalStateException:
Unexpected end-of-file,
publisher/clusterfuzz-testcase-minimized-POIHPBFFuzzer-6325615354773504.pub,"handle,extract",HPBF,,java.lang.IllegalArgumentException,File
invalid - failed to find document entry,
slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6071540680032256.pptx,extract,"XSLF,OPC",,java.lang.IllegalStateException,"Invalid
content in diagram, cannot extract text",
slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6071540680032256.pptx,handle,XSLF,,java.lang.IllegalStateException,SlideMaster
was not found for Name,
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
