naruto-lgtm opened a new pull request, #1387: URL: https://github.com/apache/poi/pull/1387
Repro: open a .doc whose PAPX FKP carries a sprmPHugePapx2 with a negative data-stream offset, a size prefix of 0x8000 or more, or a size that runs to the last byte of the data stream. Cause: findHuge takes the 32-bit operand and the two-byte size prefix as signed values, and the bounds check compares offset+size against the stream length while the copy starts two bytes after the prefix. Fix: reject negative offsets, read the size prefix with getUShort, and bound it to the bytes remaining after the prefix, so malformed records fall back to the existing 8-byte stub path instead of surfacing ArrayIndexOutOfBoundsException or NegativeArraySizeException from HWPFDocument parsing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
