This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new c60d26562d Apply allocation bounds checks to EmfPolyDraw and
WmfCreateRegion (#1107)
c60d26562d is described below
commit c60d26562d202ed1b39fb06261ef8b39447c135b
Author: sahvx655-wq <[email protected]>
AuthorDate: Thu Jun 4 01:10:40 2026 +0530
Apply allocation bounds checks to EmfPolyDraw and WmfCreateRegion (#1107)
Co-authored-by: “sahvx655-wq” <“[email protected]”>
---
.../main/java/org/apache/poi/hemf/record/emf/HemfDraw.java | 2 ++
.../main/java/org/apache/poi/hwmf/record/HwmfWindowing.java | 4 +++-
.../java/org/apache/poi/hemf/usermodel/TestHemfPicture.java | 12 ++++++++++++
.../src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java | 13 +++++++++++++
4 files changed, 30 insertions(+), 1 deletion(-)
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfDraw.java
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfDraw.java
index 716b2ace2a..dca405cc90 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfDraw.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfDraw.java
@@ -37,6 +37,7 @@ import org.apache.poi.hemf.draw.HemfGraphics;
import org.apache.poi.hwmf.draw.HwmfGraphics.FillDrawStyle;
import org.apache.poi.hwmf.record.HwmfDraw;
import org.apache.poi.hwmf.record.HwmfDraw.WmfSelectObject;
+import org.apache.poi.hwmf.usermodel.HwmfPicture;
import org.apache.poi.util.GenericRecordJsonWriter;
import org.apache.poi.util.GenericRecordUtil;
import org.apache.poi.util.IOUtils;
@@ -947,6 +948,7 @@ public final class HemfDraw {
long size = readRectL(leis, bounds);
int count = Math.toIntExact(leis.readUInt());
size += LittleEndianConsts.INT_SIZE;
+ IOUtils.safelyAllocateCheck(count,
HwmfPicture.getMaxRecordLength());
Point2D[] points = new Point2D[count];
for (int i=0; i<count; i++) {
points[i] = new Point2D.Double();
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfWindowing.java
b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfWindowing.java
index d323f86106..3d7ba8ee80 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfWindowing.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfWindowing.java
@@ -37,9 +37,11 @@ import java.util.function.Supplier;
import org.apache.poi.common.usermodel.GenericRecord;
import org.apache.poi.hwmf.draw.HwmfDrawProperties;
import org.apache.poi.hwmf.draw.HwmfGraphics;
+import org.apache.poi.hwmf.usermodel.HwmfPicture;
import org.apache.poi.util.Dimension2DDouble;
import org.apache.poi.util.GenericRecordJsonWriter;
import org.apache.poi.util.GenericRecordUtil;
+import org.apache.poi.util.IOUtils;
import org.apache.poi.util.LittleEndianConsts;
import org.apache.poi.util.LittleEndianInputStream;
@@ -741,7 +743,7 @@ public class HwmfWindowing {
bounds.setRect(left, top, right-left, bottom-top);
int size =
9*LittleEndianConsts.SHORT_SIZE+LittleEndianConsts.INT_SIZE;
-
+ IOUtils.safelyAllocateCheck(scanCount,
HwmfPicture.getMaxRecordLength());
scanObjects = new WmfScanObject[scanCount];
for (int i=0; i<scanCount; i++) {
size += (scanObjects[i] = new WmfScanObject()).init(leis);
diff --git
a/poi-scratchpad/src/test/java/org/apache/poi/hemf/usermodel/TestHemfPicture.java
b/poi-scratchpad/src/test/java/org/apache/poi/hemf/usermodel/TestHemfPicture.java
index 7fa968d9d3..7211a9de20 100644
---
a/poi-scratchpad/src/test/java/org/apache/poi/hemf/usermodel/TestHemfPicture.java
+++
b/poi-scratchpad/src/test/java/org/apache/poi/hemf/usermodel/TestHemfPicture.java
@@ -40,6 +40,7 @@ import org.apache.poi.hemf.record.emf.HemfComment;
import org.apache.poi.hemf.record.emf.HemfComment.EmfComment;
import org.apache.poi.hemf.record.emf.HemfComment.EmfCommentDataFormat;
import org.apache.poi.hemf.record.emf.HemfComment.EmfCommentDataMultiformats;
+import org.apache.poi.hemf.record.emf.HemfDraw;
import org.apache.poi.hemf.record.emf.HemfHeader;
import org.apache.poi.hemf.record.emf.HemfRecord;
import org.apache.poi.hemf.record.emf.HemfRecordType;
@@ -254,6 +255,17 @@ public class TestHemfPicture {
}
}
+ @Test
+ void testEmfPolyDrawInvalidCount() throws Exception {
+ HemfDraw.EmfPolyDraw record = new HemfDraw.EmfPolyDraw();
+ byte[] data = new byte[20];
+ org.apache.poi.util.LittleEndian.putInt(data, 16, Integer.MAX_VALUE);
+ try (LittleEndianInputStream leis = new LittleEndianInputStream(new
ByteArrayInputStream(data))) {
+ assertThrows(RecordFormatException.class,
+ () -> record.init(leis, data.length,
HemfRecordType.polyDraw.id));
+ }
+ }
+
@Test
void nestedWmfEmf() throws Exception {
try (InputStream is =
sl_samples.openResourceAsStream("nested_wmf.emf")) {
diff --git
a/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java
b/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java
index 4a145d8479..be741abe3f 100644
--- a/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java
@@ -41,9 +41,11 @@ import org.apache.poi.hwmf.record.HwmfPlaceableHeader;
import org.apache.poi.hwmf.record.HwmfRecord;
import org.apache.poi.hwmf.record.HwmfRecordType;
import org.apache.poi.hwmf.record.HwmfText;
+import org.apache.poi.hwmf.record.HwmfWindowing;
import org.apache.poi.hwmf.usermodel.HwmfPicture;
import org.apache.poi.sl.usermodel.PictureData;
import org.apache.poi.util.IOUtils;
+import org.apache.poi.util.LittleEndianInputStream;
import org.apache.poi.util.LocaleUtil;
import org.apache.poi.util.RecordFormatException;
import org.junit.jupiter.api.Disabled;
@@ -183,6 +185,17 @@ public class TestHwmfParsing {
assertContains(ex.getMessage(), "unitsPerInch");
}
+ @Test
+ void testWmfCreateRegionInvalidScanCount() throws Exception {
+ HwmfWindowing.WmfCreateRegion record = new
HwmfWindowing.WmfCreateRegion();
+ byte[] data = new byte[34];
+ org.apache.poi.util.LittleEndian.putShort(data, 10, (short) -1);
+ try (LittleEndianInputStream leis = new LittleEndianInputStream(new
ByteArrayInputStream(data))) {
+ assertThrows(RecordFormatException.class,
+ () -> record.init(leis, data.length, 0));
+ }
+ }
+
@Test
void testValidUnitsProduceFiniteDimensions() throws IOException {
byte[] benign = createMinimalPlaceableWmf(1440, 0, 0, 100, 100);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
