billowgao opened a new pull request, #1276:
URL: https://github.com/apache/poi/pull/1276
### Problem
`EscherBSERecord.fillFields()` subtracts the fixed 36-byte BSE
record header from `bytesRemaining` without checking whether the
declared record size is smaller than 36 bytes.
For malformed files with a truncated BSE record, this can make
`bytesRemaining` negative and later cause a negative-size operation.
### Change
Clamp `bytesRemaining` to zero when subtracting the fixed record
size and embedded blip size.
This does not catch or suppress parser exceptions; it only prevents
the remaining-byte count from becoming negative.
### Test
Added a regression XLS containing a BSE record whose declared
payload is 35 bytes.
The test reproduces the failure before the change and passes after
the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
