This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new 103dd47963 HemfPlusPath: validate PointCount before array allocation
(#1103)
103dd47963 is described below
commit 103dd47963b85a2c15ef3474170a2cd950ab458a
Author: jmestwa-coder <[email protected]>
AuthorDate: Thu Jun 4 23:40:27 2026 +0530
HemfPlusPath: validate PointCount before array allocation (#1103)
---
.../java/org/apache/poi/hemf/record/emfplus/HemfPlusPath.java | 4 +++-
.../org/apache/poi/hemf/record/emfplus/TestHemfPlusPath.java | 9 ++++++---
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emfplus/HemfPlusPath.java
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emfplus/HemfPlusPath.java
index 29a17d1dd3..6a180666e7 100644
---
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emfplus/HemfPlusPath.java
+++
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emfplus/HemfPlusPath.java
@@ -42,7 +42,6 @@ import org.apache.poi.hemf.usermodel.HemfPicture;
import org.apache.poi.util.BitField;
import org.apache.poi.util.BitFieldFactory;
import org.apache.poi.util.GenericRecordUtil;
-import org.apache.poi.util.IOUtils;
import org.apache.poi.util.LittleEndianConsts;
import org.apache.poi.util.LittleEndianInputStream;
@@ -121,6 +120,9 @@ public class HemfPlusPath {
readPoint = HemfPlusDraw::readPointF;
}
+ // pointCount is an untrusted 32-bit field that is used as the
length of both arrays below.
+ // Reject negative and oversized values before allocating, so a
malformed path can't trigger
+ // a NegativeArraySizeException or an OutOfMemoryError instead of
the usual RecordFormatException.
HemfPicture.safelyAllocateCheck(pointCount);
pathPoints = new Point2D[pointCount];
for (int i=0; i<pointCount; i++) {
diff --git
a/poi-scratchpad/src/test/java/org/apache/poi/hemf/record/emfplus/TestHemfPlusPath.java
b/poi-scratchpad/src/test/java/org/apache/poi/hemf/record/emfplus/TestHemfPlusPath.java
index 02706f5d3c..876f1df826 100644
---
a/poi-scratchpad/src/test/java/org/apache/poi/hemf/record/emfplus/TestHemfPlusPath.java
+++
b/poi-scratchpad/src/test/java/org/apache/poi/hemf/record/emfplus/TestHemfPlusPath.java
@@ -65,11 +65,14 @@ class TestHemfPlusPath {
/**
* EmfPlusPath reads a 32-bit point count straight from the EMF+ stream and
* allocates the point/type arrays before any point data is read. A crafted
- * count (oversized or negative) must be rejected by the standard
allocation
- * check instead of triggering an OutOfMemoryError /
NegativeArraySizeException.
+ * count must be rejected by the standard allocation check instead of
triggering
+ * an OutOfMemoryError / NegativeArraySizeException. The values below
cover both
+ * high-bit (negative) counts - e.g. 0x80000000 / 0xFFFFFFFF would yield
+ * {@code new Point2D[negative]} - and large positive counts - e.g.
0x40000000
+ * (~1 billion points in a 12-byte record) would attempt a multi-GB
allocation.
*/
@ParameterizedTest
- @ValueSource(ints = { Integer.MAX_VALUE, 0xFFFFFFFF })
+ @ValueSource(ints = { Integer.MAX_VALUE, 0xFFFFFFFF, 0x80000000,
0x40000000 })
void rejectsInvalidPointCount(int pointCount) throws Exception {
byte[] data = new byte[12];
// EmfPlusGraphicsVersion: metafile signature 0xDBC01, graphics
version 1
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
