pjfanning opened a new pull request, #1408: URL: https://github.com/apache/poi/pull/1408
Follow-up to #1407, in `HemfFill.readBitmap`: - **Bound the copies by the record.** A bitmap whose `offBmi+cbBmi` or `offBits+cbBits` ends past the record is now rejected with a `RecordFormatException` before anything is buffered. Before, the `IOUtils.copy` calls were bounded only by the untrusted header sizes, and the overrun was caught later by `HemfRecordIterator`'s `readBytes > remBytes` check. Such records already failed there, so valid files are not affected. `readBitmap` (package-private) now takes `recordSize`, and its 7 callers in `HemfFill`/`HemfMisc` pass it. - **Reject overflowing sizes.** `cbBmi+cbBits` is now computed as a `long`. Sizes that overflow an `int` are rejected instead of passing a negative `dibSize` to `HwmfBitmapDib.init`. - **Use the EMF limit for the presize hint.** The hint is now capped by `HemfPicture.getMaxRecordLength()` (1 MB by default), not `HwmfPicture`'s 100 MB. It's only a hint, so larger bitmaps still grow the buffer, and the DIB allocation itself is still checked against `HwmfPicture`'s limit in `HwmfBitmapDib`. - **Make the test specific.** `TestHemfFill` now asserts `RecordFormatException` instead of "any Throwable except OOM", which depended on heap size and on `-ea` being on. A test for the overflow case is added. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
