Apache
/
poi
mirror of https://github.com/apache/poi.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add length sanity check for length of embedded OLE10Native (BUG 60256) 

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1764927 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Tim Allison 2016-10-14 14:57:29 +00:00
parent 54a6e0f070
commit 1d0badc7c8
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/java/org/apache/poi/poifs/filesystem/Ole10Native.java
View File

@ -193,6 +193,9 @@ public class Ole10Native {
break; break;
} }
if ((long)dataSize + (long)ofs > (long)data.length) { //cast to avoid overflow
throw new Ole10NativeException("Invalid Ole10Native: declared data length > available data");
}
dataBuffer = new byte[dataSize]; dataBuffer = new byte[dataSize];
System.arraycopy(data, ofs, dataBuffer, 0, dataSize); System.arraycopy(data, ofs, dataBuffer, 0, dataSize);
ofs += dataSize; ofs += dataSize;

10
src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java
View File

@ -20,6 +20,8 @@ package org.apache.poi.poifs.filesystem;
import static org.hamcrest.core.IsEqual.equalTo; import static org.hamcrest.core.IsEqual.equalTo;
import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertThat; import static org.junit.Assert.assertThat;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
import java.io.ByteArrayOutputStream; import java.io.ByteArrayOutputStream;
import java.io.File; import java.io.File;
@ -110,10 +112,14 @@ public class TestOle10Native {
} }
@Test @Test
@Ignore("BUG 60256")
public void testOleNativeOOM() throws IOException, Ole10NativeException { public void testOleNativeOOM() throws IOException, Ole10NativeException {
POIFSFileSystem fs = new POIFSFileSystem(dataSamples.openResourceAsStream("60256.bin")); POIFSFileSystem fs = new POIFSFileSystem(dataSamples.openResourceAsStream("60256.bin"));
Ole10Native ole = Ole10Native.createFromEmbeddedOleObject(fs); try {
Ole10Native.createFromEmbeddedOleObject(fs);
fail("Should have thrown exception because OLENative lacks a length parameter");
} catch (Ole10NativeException e) {
assertTrue(e.getMessage().indexOf("declared data length") > -1);
}
} }
} }