Apache
/
poi
mirror of https://github.com/apache/poi.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Better handling of zero sized images, and where the picture stream doesn't have enough data left for a full header 

git-svn-id: https://svn.apache.org/repos/asf/jakarta/poi/trunk@413658 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Nick Burch 2006-06-12 14:06:08 +00:00
parent 30541423a2
commit 3e964966cc
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/scratchpad/src/org/apache/poi/hslf/HSLFSlideShow.java
View File

@ -219,7 +219,7 @@ public class HSLFSlideShow extends POIDocument
ArrayList p = new ArrayList();
int pos = 0;
while (pos < pictstream.length) {
while (pos < (pictstream.length - PictureData.HEADER_SIZE)) {
PictureData pict = new PictureData(pictstream, pos);
p.add(pict);
pos += PictureData.HEADER_SIZE + pict.getSize();

15
src/scratchpad/src/org/apache/poi/hslf/usermodel/PictureData.java
View File

@ -63,9 +63,20 @@ public class PictureData {
header = new byte[PictureData.HEADER_SIZE];
System.arraycopy(pictstream, offset, header, 0, header.length);
int size = LittleEndian.getInt(header, 4) - 17;
// Get the size of the picture, and make sure it's sane
// Size is stored unsigned, since it must always be positive
int size = (int)LittleEndian.getUInt(header, 4) - 17;
int startPos = offset + PictureData.HEADER_SIZE;
if(size < 0) { size = 0; }
if(size > (pictstream.length - startPos)) {
int remaining = pictstream.length - startPos;
System.err.println("Warning: PictureData claimed picture was of length " + size + ", but only " + remaining + " remained!");
size = remaining;
}
// Save the picture data
pictdata = new byte[size];
System.arraycopy(pictstream, offset + PictureData.HEADER_SIZE, pictdata, 0, pictdata.length);
System.arraycopy(pictstream, startPos, pictdata, 0, pictdata.length);
}
/**