This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new 9d16d56147 Use unsigned element count when parsing EscherArrayProperty
(#1116)
9d16d56147 is described below
commit 9d16d561477cf0675cd9107d7baa91f4e80cd421
Author: jmestwa-coder <[email protected]>
AuthorDate: Thu Jun 4 23:41:21 2026 +0530
Use unsigned element count when parsing EscherArrayProperty (#1116)
---
.../org/apache/poi/ddf/EscherArrayProperty.java | 2 +-
.../apache/poi/ddf/TestEscherArrayProperty.java | 58 ++++++++++++++++++++++
2 files changed, 59 insertions(+), 1 deletion(-)
diff --git a/poi/src/main/java/org/apache/poi/ddf/EscherArrayProperty.java
b/poi/src/main/java/org/apache/poi/ddf/EscherArrayProperty.java
index 9aa6bf7937..cbd39b630c 100644
--- a/poi/src/main/java/org/apache/poi/ddf/EscherArrayProperty.java
+++ b/poi/src/main/java/org/apache/poi/ddf/EscherArrayProperty.java
@@ -175,7 +175,7 @@ public final class EscherArrayProperty extends
EscherComplexProperty implements
if (emptyComplexPart) {
resizeComplexData(0);
} else {
- short numElements = LittleEndian.getShort(data, offset);
+ int numElements = LittleEndian.getUShort(data, offset);
// LittleEndian.getShort(data, offset + 2); // numReserved
short sizeOfElements = LittleEndian.getShort(data, offset + 4);
diff --git a/poi/src/test/java/org/apache/poi/ddf/TestEscherArrayProperty.java
b/poi/src/test/java/org/apache/poi/ddf/TestEscherArrayProperty.java
new file mode 100644
index 0000000000..4df4ac38e3
--- /dev/null
+++ b/poi/src/test/java/org/apache/poi/ddf/TestEscherArrayProperty.java
@@ -0,0 +1,58 @@
+/* ====================================================================
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+==================================================================== */
+
+package org.apache.poi.ddf;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.apache.poi.util.LittleEndian;
+import org.junit.jupiter.api.Test;
+
+class TestEscherArrayProperty {
+
+ /**
+ * {@code OfficeArtArrayPropertyData.nElems} is an unsigned 16-bit integer
+ * ([MS-ODRAW] 2.3.7.2). {@link EscherArrayProperty#setArrayData} must
read it
+ * with {@code getUShort}, consistently with the
+ * {@link EscherArrayProperty#getNumberOfElementsInArray()} and
+ * {@link EscherArrayProperty#getNumberOfElementsInMemory()} accessors
(both
+ * {@code getUShort}). Reading it as a signed short makes the
+ * {@code arraySize == complexSize} "size excludes header" detection fail
for
+ * arrays with 32768..65535 elements, leaving {@code
sizeIncludesHeaderSize}
+ * wrong and mis-sizing the property when it is serialized again.
+ */
+ @Test
+ void setArrayDataReadsElementCountAsUnsigned() {
+ final int nElems = 0x8000; // 32768 -> negative when read
as signed short
+ final short cbElem = 2; // bytes per element
+ final int arraySize = nElems * cbElem; // 65536
+
+ // "size excludes header" layout: the simple-part complexSize equals
arraySize
+ EscherArrayProperty prop = new EscherArrayProperty((short) 0x0145,
arraySize);
+
+ byte[] data = new byte[6];
+ LittleEndian.putUShort(data, 0, nElems); // nElems
+ LittleEndian.putUShort(data, 2, nElems); // nElemsInMemory
+ LittleEndian.putShort(data, 4, cbElem); // cbElem
+
+ prop.setArrayData(data, 0);
+
+ // With nElems read as unsigned, arraySize == complexSize is detected
and the
+ // 6-byte array header is added back; read as signed, that detection
fails.
+ assertEquals(arraySize + 6, prop.getComplexSize());
+ }
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
