naruto-lgtm opened a new pull request, #1496: URL: https://github.com/apache/poi/pull/1496
Repro: run VBAMacroReader.readMacros, or RLEDecompressingInputStream.decompress, on a compressed VBA stream whose chunk opens with a copy token (01 02 B0 01 00 00) or carries token 0x0FFF after one literal (01 03 B0 02 41 FF 0F); both end in ArrayIndexOutOfBoundsException. A chunk that is only a flag byte makes the single-byte read() return the previous chunk's first byte, while the bulk read for the same stream does not. Cause: readChunk expands a CopyToken without the two checks MS-OVBA 2.4.1.3.19 requires, that the back-reference stays inside the bytes already decompressed in the chunk and that a chunk never exceeds 4096 bytes, so the private buffer is indexed at -1 or 4096. VBAMacroReader only treats IllegalArgumentException and IllegalStateException as corrupt compressed data, so the index error skips the brute-force module recovery and tryToDecompress and aborts the whole extraction. read() also returns buf[pos++] when readChunk produced zero bytes, so the dir stream parser, which goes through readShort/readInt, picks up a stale byte and desynchronises. Fix: reject a copy offset that reaches before the chunk start and a copy or literal that would overflow the chunk buffer with IllegalStateException, which the callers already handle, and let read() skip empty chunks the way the bulk path does. A chunk that decompresses to exactly 4096 bytes is still accepted and the MS-OVBA sample streams decode unchanged. The new tests in TestRLEDecompressingInputStream cover the three overruns and the empty chunk and fail before the change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
