This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new 69f8eb6fb8 apply allocation bounds check to EmfExtCreatePen style
entries (#1113)
69f8eb6fb8 is described below
commit 69f8eb6fb8616b541a04b85d483b2dbd0706ec73
Author: metsw24-max <[email protected]>
AuthorDate: Fri Jun 5 00:12:51 2026 +0530
apply allocation bounds check to EmfExtCreatePen style entries (#1113)
---
.../org/apache/poi/hemf/record/emf/HemfMisc.java | 2 +
.../apache/poi/hemf/record/emf/TestHemfMisc.java | 54 ++++++++++++++++++++++
2 files changed, 56 insertions(+)
diff --git
a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfMisc.java
b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfMisc.java
index fb72174e61..f792d94762 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfMisc.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfMisc.java
@@ -32,6 +32,7 @@ import java.util.function.Supplier;
import org.apache.poi.hemf.draw.HemfDrawProperties;
import org.apache.poi.hemf.draw.HemfGraphics;
+import org.apache.poi.hemf.usermodel.HemfPicture;
import org.apache.poi.hwmf.draw.HwmfDrawProperties;
import org.apache.poi.hwmf.draw.HwmfGraphics;
import org.apache.poi.hwmf.record.HwmfBinaryRasterOp;
@@ -624,6 +625,7 @@ public class HemfMisc {
// If the pen type in the PenStyle field is PS_GEOMETRIC, the
lengths are specified in logical
// units; otherwise, the lengths are specified in device units.
+ HemfPicture.safelyAllocateCheck(numStyleEntries);
float[] dashPattern = new float[numStyleEntries];
for (int i = 0; i < numStyleEntries; i++) {
diff --git
a/poi-scratchpad/src/test/java/org/apache/poi/hemf/record/emf/TestHemfMisc.java
b/poi-scratchpad/src/test/java/org/apache/poi/hemf/record/emf/TestHemfMisc.java
new file mode 100644
index 0000000000..23113b36bc
--- /dev/null
+++
b/poi-scratchpad/src/test/java/org/apache/poi/hemf/record/emf/TestHemfMisc.java
@@ -0,0 +1,54 @@
+/* ====================================================================
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+==================================================================== */
+
+package org.apache.poi.hemf.record.emf;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import java.io.ByteArrayInputStream;
+
+import org.apache.poi.hemf.record.emf.HemfMisc.EmfExtCreatePen;
+import org.apache.poi.util.LittleEndian;
+import org.apache.poi.util.LittleEndianInputStream;
+import org.apache.poi.util.RecordFormatException;
+import org.junit.jupiter.api.Test;
+
+class TestHemfMisc {
+
+ /**
+ * EMR_EXTCREATEPEN reads the unsigned NumStyleEntries field straight from
the
+ * record and uses it as the length of the dash-pattern array. A crafted
count
+ * of 0x40000000 makes that allocation enormous, and a high-bit value turns
+ * negative when narrowed to int, so the count has to be capped before the
+ * array is created.
+ */
+ @Test
+ void numStyleEntriesIsBounded() throws Exception {
+ byte[] data = new byte[44];
+ for (int i = 0; i < 10; i++) {
+ LittleEndian.putInt(data, i * 4, 0); // penIndex .. hatchStyle
+ }
+ LittleEndian.putInt(data, 20, 0x7); // penStyle with
PS_USERSTYLE line dash
+ LittleEndian.putInt(data, 40, 0x40000000); // numStyleEntries
+
+ EmfExtCreatePen record = new EmfExtCreatePen();
+ try (LittleEndianInputStream leis = new LittleEndianInputStream(new
ByteArrayInputStream(data))) {
+ assertThrows(RecordFormatException.class,
+ () -> record.init(leis, (long) data.length, (long) 0x5F));
+ }
+ }
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
