From 7ed2c1e85af772be8821524f9a5599be0f8f7bfa Mon Sep 17 00:00:00 2001 From: Andreas Beeker Date: Wed, 8 Feb 2017 01:01:51 +0000 Subject: [PATCH] #60626 - ArrayIndexOutOfBoundsException in EvilUnclosedBRFixingInputStream git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1782095 13f79535-47bb-0310-9956-ffa450edef68 --- legal/LICENSE | 26 +- .../apache/poi/util/ReplacingInputStream.java | 204 ++++++ .../poi/xssf/usermodel/XSSFVMLDrawing.java | 14 +- .../util/EvilUnclosedBRFixingInputStream.java | 185 +---- .../xssf/usermodel/TestXSSFVMLDrawing.java | 48 +- .../TestEvilUnclosedBRFixingInputStream.java | 152 ++-- test-data/openxml4j/bug-60626.vml | 658 ++++++++++++++++++ 7 files changed, 1014 insertions(+), 273 deletions(-) create mode 100644 src/java/org/apache/poi/util/ReplacingInputStream.java create mode 100644 test-data/openxml4j/bug-60626.vml diff --git a/legal/LICENSE b/legal/LICENSE index 19246db04c..3b63d08dd5 100644 --- a/legal/LICENSE +++ b/legal/LICENSE @@ -510,4 +510,28 @@ SLF4J library (slf4j-api-*.jar) NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION - WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +inbot-utils (https://github.com/Inbot/inbot-utils) + + The MIT License (MIT) + + Copyright (c) 2015 Inbot + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. \ No newline at end of file diff --git a/src/java/org/apache/poi/util/ReplacingInputStream.java b/src/java/org/apache/poi/util/ReplacingInputStream.java new file mode 100644 index 0000000000..1b5430e991 --- /dev/null +++ b/src/java/org/apache/poi/util/ReplacingInputStream.java @@ -0,0 +1,204 @@ +/* ==================================================================== + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +==================================================================== */ + +package org.apache.poi.util; + +import java.io.FilterInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.nio.charset.Charset; +import java.util.Arrays; + +/** + * Simple FilterInputStream that can replace occurrences of bytes with something else. + * + * This has been taken from inbot-utils. (MIT licensed) + * + * @see inbot-utils + */ +@Internal +public class ReplacingInputStream extends FilterInputStream { + + // while matching, this is where the bytes go. + final int[] buf; + private int matchedIndex=0; + private int unbufferIndex=0; + private int replacedIndex=0; + + private final byte[] pattern; + private final byte[] replacement; + private State state=State.NOT_MATCHED; + + // simple state machine for keeping track of what we are doing + private enum State { + NOT_MATCHED, + MATCHING, + REPLACING, + UNBUFFER + } + + private static final Charset UTF8 = Charset.forName("UTF-8"); + + /** + * Replace occurrences of pattern in the input. Note: input is assumed to be UTF-8 encoded. If not the case use byte[] based pattern and replacement. + * @param in input + * @param pattern pattern to replace. + * @param replacement the replacement or null + */ + public ReplacingInputStream(InputStream in, String pattern, String replacement) { + this(in, pattern.getBytes(UTF8), replacement==null ? null : replacement.getBytes(UTF8)); + } + + /** + * Replace occurrences of pattern in the input.

+ * + * If you want to normalize line endings DOS/MAC (\n\r | \r) to UNIX (\n), you can call the following:
+ * {@code new ReplacingInputStream(new ReplacingInputStream(is, "\n\r", "\n"), "\r", "\n")} + * + * @param in input + * @param pattern pattern to replace + * @param replacement the replacement or null + */ + public ReplacingInputStream(InputStream in, byte[] pattern, byte[] replacement) { + super(in); + if (pattern == null || pattern.length == 0) { + throw new IllegalArgumentException("pattern length should be > 0"); + } + this.pattern = pattern; + this.replacement = replacement; + // we will never match more than the pattern length + buf = new int[pattern.length]; + } + + @Override + public int read(byte[] b, int off, int len) throws IOException { + // copy of parent logic; we need to call our own read() instead of super.read(), which delegates instead of calling our read + if (b == null) { + throw new NullPointerException(); + } else if (off < 0 || len < 0 || len > b.length - off) { + throw new IndexOutOfBoundsException(); + } else if (len == 0) { + return 0; + } + + int c = read(); + if (c == -1) { + return -1; + } + b[off] = (byte)c; + + int i = 1; + for (; i < len ; i++) { + c = read(); + if (c == -1) { + break; + } + b[off + i] = (byte)c; + } + return i; + + } + + @Override + public int read(byte[] b) throws IOException { + // call our own read + return read(b, 0, b.length); + } + + @Override + public int read() throws IOException { + // use a simple state machine to figure out what we are doing + int next; + switch (state) { + default: + case NOT_MATCHED: + // we are not currently matching, replacing, or unbuffering + next=super.read(); + if (pattern[0] != next) { + return next; + } + + // clear whatever was there + Arrays.fill(buf, 0); + // make sure we start at 0 + matchedIndex=0; + + buf[matchedIndex++]=next; + if (pattern.length == 1) { + // edge-case when the pattern length is 1 we go straight to replacing + state=State.REPLACING; + // reset replace counter + replacedIndex=0; + } else { + // pattern of length 1 + state=State.MATCHING; + } + // recurse to continue matching + return read(); + + case MATCHING: + // the previous bytes matched part of the pattern + next=super.read(); + if (pattern[matchedIndex]==next) { + buf[matchedIndex++]=next; + if (matchedIndex==pattern.length) { + // we've found a full match! + if (replacement==null || replacement.length==0) { + // the replacement is empty, go straight to NOT_MATCHED + state=State.NOT_MATCHED; + matchedIndex=0; + } else { + // start replacing + state=State.REPLACING; + replacedIndex=0; + } + } + } else { + // mismatch -> unbuffer + buf[matchedIndex++]=next; + state=State.UNBUFFER; + unbufferIndex=0; + } + return read(); + + case REPLACING: + // we've fully matched the pattern and are returning bytes from the replacement + next=replacement[replacedIndex++]; + if (replacedIndex==replacement.length) { + state=State.NOT_MATCHED; + replacedIndex=0; + } + return next; + + case UNBUFFER: + // we partially matched the pattern before encountering a non matching byte + // we need to serve up the buffered bytes before we go back to NOT_MATCHED + next=buf[unbufferIndex++]; + if (unbufferIndex==matchedIndex) { + state=State.NOT_MATCHED; + matchedIndex=0; + } + return next; + } + } + + @Override + public String toString() { + return state.name() + " " + matchedIndex + " " + replacedIndex + " " + unbufferIndex; + } + +} \ No newline at end of file diff --git a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java index 352b804b9a..7a7f02f6cd 100644 --- a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java +++ b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java @@ -34,7 +34,7 @@ import javax.xml.namespace.QName; import org.apache.poi.POIXMLDocumentPart; import org.apache.poi.openxml4j.opc.PackagePart; import org.apache.poi.util.DocumentHelper; -import org.apache.poi.xssf.util.EvilUnclosedBRFixingInputStream; +import org.apache.poi.util.ReplacingInputStream; import org.apache.xmlbeans.XmlCursor; import org.apache.xmlbeans.XmlException; import org.apache.xmlbeans.XmlObject; @@ -124,7 +124,13 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart { protected void read(InputStream is) throws IOException, XmlException { Document doc; try { - doc = DocumentHelper.readDocument(new EvilUnclosedBRFixingInputStream(is)); + /* + * This is a seriously sick fix for the fact that some .xlsx files contain raw bits + * of HTML, without being escaped or properly turned into XML. + * The result is that they contain things like >br<, which breaks the XML parsing. + * This very sick InputStream wrapper attempts to spot these go past, and fix them. + */ + doc = DocumentHelper.readDocument(new ReplacingInputStream(is, "
", "
")); } catch (SAXException e) { throw new XmlException(e.getMessage(), e); } @@ -146,7 +152,9 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart { String id = shape.getId(); if(id != null) { Matcher m = ptrn_shapeId.matcher(id); - if(m.find()) _shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1))); + if(m.find()) { + _shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1))); + } } _items.add(shape); } else { diff --git a/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java b/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java index 5fae1ea1c6..0ef1aeeb5e 100644 --- a/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java +++ b/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java @@ -16,9 +16,11 @@ ==================================================================== */ package org.apache.poi.xssf.util; -import java.io.IOException; import java.io.InputStream; -import java.util.ArrayList; + +import org.apache.poi.util.Internal; +import org.apache.poi.util.Removal; +import org.apache.poi.util.ReplacingInputStream; /** * This is a seriously sick fix for the fact that some .xlsx @@ -31,179 +33,14 @@ import java.util.ArrayList; * Only works for UTF-8 and US-ASCII based streams! * It should only be used where experience shows the problem * can occur... + * + * @deprecated 3.16-beta2 - use ReplacingInputStream(source, ">br<", ">br/<") */ -public class EvilUnclosedBRFixingInputStream extends InputStream { - private InputStream source; - private byte[] spare; - - private static byte[] detect = new byte[] { - (byte)'<', (byte)'b', (byte)'r', (byte)'>' - }; - +@Deprecated +@Removal(version="3.18") +@Internal +public class EvilUnclosedBRFixingInputStream extends ReplacingInputStream { public EvilUnclosedBRFixingInputStream(InputStream source) { - this.source = source; - } - - /** - * Warning - doesn't fix! - */ - @Override - public int read() throws IOException { - return source.read(); - } - - @Override - public int read(byte[] b, int off, int len) throws IOException { - // Grab any data left from last time - int readA = readFromSpare(b, off, len); - - // Now read from the stream - int readB = source.read(b, off+readA, len-readA); - - // Figure out how much we've done - int read; - if(readB == -1 || readB == 0) { - if (readA == 0) { - return readB; - } - read = readA; - } else { - read = readA + readB; - } - - // Fix up our data - if(read > 0) { - read = fixUp(b, off, read); - } - - // All done - return read; - } - - @Override - public int read(byte[] b) throws IOException { - return this.read(b, 0, b.length); - } - - /** - * Reads into the buffer from the spare bytes - */ - private int readFromSpare(byte[] b, int offset, int len) { - if(spare == null) return 0; - if(len == 0) throw new IllegalArgumentException("Asked to read 0 bytes"); - - if(spare.length <= len) { - // All fits, good - System.arraycopy(spare, 0, b, offset, spare.length); - int read = spare.length; - spare = null; - return read; - } else { - // We have more spare than they can copy with... - byte[] newspare = new byte[spare.length-len]; - System.arraycopy(spare, 0, b, offset, len); - System.arraycopy(spare, len, newspare, 0, newspare.length); - spare = newspare; - return len; - } - } - private void addToSpare(byte[] b, int offset, int len, boolean atTheEnd) { - if(spare == null) { - spare = new byte[len]; - System.arraycopy(b, offset, spare, 0, len); - } else { - byte[] newspare = new byte[spare.length+len]; - if(atTheEnd) { - System.arraycopy(spare, 0, newspare, 0, spare.length); - System.arraycopy(b, offset, newspare, spare.length, len); - } else { - System.arraycopy(b, offset, newspare, 0, len); - System.arraycopy(spare, 0, newspare, len, spare.length); - } - spare = newspare; - } - } - - private int fixUp(byte[] b, int offset, int read) { - // Do we have any potential overhanging ones? - for(int i=0; i handing over the end, eg fixAt = new ArrayList(); - for(int i=offset; i<=offset+read-detect.length; i++) { - boolean going = true; - for(int j=0; j 0) { - // Make sure we don't loose part of a
! - int fixes = 0; - for(int at : fixAt) { - if(at > offset+read-detect.length-overshoot-fixes) { - overshoot = needed - at - 1 - fixes; - break; - } - fixes++; - } - - addToSpare(b, offset+read-overshoot, overshoot, false); - read -= overshoot; - } - - // Fix them, in reverse order so the - // positions are valid - for(int j=fixAt.size()-1; j>=0; j--) { - int i = fixAt.get(j); - if(i >= read+offset) { - // This one has moved into the overshoot - continue; - } - if(i > read-3) { - // This one has moved into the overshoot - continue; - } - - byte[] tmp = new byte[read-i-3]; - System.arraycopy(b, i+3, tmp, 0, tmp.length); - b[i+3] = (byte)'/'; - System.arraycopy(tmp, 0, b, i+4, tmp.length); - // It got one longer - read++; - } - return read; + super(source, "
", "
"); } } diff --git a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java index 4ae2b8b052..b8dbd36a71 100644 --- a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java +++ b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java @@ -16,18 +16,28 @@ ==================================================================== */ package org.apache.poi.xssf.usermodel; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertNull; +import static org.junit.Assert.assertSame; +import static org.junit.Assert.assertTrue; + import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; +import java.io.IOException; import java.io.InputStream; import java.math.BigInteger; import java.util.List; +import java.util.regex.Pattern; -import com.microsoft.schemas.office.excel.STTrueFalseBlank; import org.apache.poi.POIDataSamples; +import org.apache.xmlbeans.XmlException; import org.apache.xmlbeans.XmlObject; +import org.junit.Test; import com.microsoft.schemas.office.excel.CTClientData; import com.microsoft.schemas.office.excel.STObjectType; +import com.microsoft.schemas.office.excel.STTrueFalseBlank; import com.microsoft.schemas.office.office.CTShapeLayout; import com.microsoft.schemas.office.office.STConnectType; import com.microsoft.schemas.office.office.STInsetMode; @@ -37,14 +47,10 @@ import com.microsoft.schemas.vml.CTShapetype; import com.microsoft.schemas.vml.STExt; import com.microsoft.schemas.vml.STTrueFalse; -import junit.framework.TestCase; +public class TestXSSFVMLDrawing { -/** - * @author Yegor Kozlov - */ -public class TestXSSFVMLDrawing extends TestCase { - - public void testNew() throws Exception { + @Test + public void testNew() throws IOException, XmlException { XSSFVMLDrawing vml = new XSSFVMLDrawing(); List items = vml.getItems(); assertEquals(2, items.size()); @@ -57,7 +63,7 @@ public class TestXSSFVMLDrawing extends TestCase { assertTrue(items.get(1) instanceof CTShapetype); CTShapetype type = (CTShapetype)items.get(1); assertEquals("21600,21600", type.getCoordsize()); - assertEquals(202.0f, type.getSpt()); + assertEquals(202.0f, type.getSpt(), 0); assertEquals("m,l,21600r21600,l21600,xe", type.getPath2()); assertEquals("_x0000_t202", type.getId()); assertEquals(STTrueFalse.T, type.getPathArray(0).getGradientshapeok()); @@ -102,7 +108,8 @@ public class TestXSSFVMLDrawing extends TestCase { assertTrue(items2.get(2) instanceof CTShape); } - public void testFindCommentShape() throws Exception { + @Test + public void testFindCommentShape() throws IOException, XmlException { XSSFVMLDrawing vml = new XSSFVMLDrawing(); InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml"); @@ -140,7 +147,8 @@ public class TestXSSFVMLDrawing extends TestCase { assertSame(sh_a1, newVml.findCommentShape(0, 1)); } - public void testRemoveCommentShape() throws Exception { + @Test + public void testRemoveCommentShape() throws IOException, XmlException { XSSFVMLDrawing vml = new XSSFVMLDrawing(); InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml"); try { @@ -156,4 +164,22 @@ public class TestXSSFVMLDrawing extends TestCase { assertNull(vml.findCommentShape(0, 0)); } + + @Test + public void testEvilUnclosedBRFixing() throws IOException, XmlException { + XSSFVMLDrawing vml = new XSSFVMLDrawing(); + InputStream stream = POIDataSamples.getOpenXML4JInstance().openResourceAsStream("bug-60626.vml"); + try { + vml.read(stream); + } finally { + stream.close(); + } + Pattern p = Pattern.compile("
"); + int count = 0; + for (XmlObject xo : vml.getItems()) { + String split[] = p.split(xo.toString()); + count += split.length-1; + } + assertEquals(16, count); + } } \ No newline at end of file diff --git a/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java b/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java index a15b22c1c1..d9010fbbc2 100644 --- a/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java +++ b/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java @@ -17,94 +17,78 @@ package org.apache.poi.xssf.util; +import static org.junit.Assert.assertArrayEquals; + import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.nio.charset.Charset; -import junit.framework.TestCase; +import org.apache.poi.util.IOUtils; +import org.apache.poi.util.ReplacingInputStream; +import org.junit.Test; -public final class TestEvilUnclosedBRFixingInputStream extends TestCase { - public void testOK() throws Exception { - byte[] ok = "

Hello There!
Tags!

".getBytes("UTF-8"); - - EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream( - new ByteArrayInputStream(ok) - ); - - ByteArrayOutputStream bout = new ByteArrayOutputStream(); - boolean going = true; - while(going) { - byte[] b = new byte[1024]; - int r = inp.read(b); - if(r > 0) { - bout.write(b, 0, r); - } else { - going = false; - } - } - - byte[] result = bout.toByteArray(); - assertEquals(ok, result); - } - - public void testProblem() throws Exception { - byte[] orig = "

Hello
There!
Tags!

".getBytes("UTF-8"); - byte[] fixed = "

Hello
There!
Tags!

".getBytes("UTF-8"); - - EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream( - new ByteArrayInputStream(orig) - ); - - ByteArrayOutputStream bout = new ByteArrayOutputStream(); - boolean going = true; - while(going) { - byte[] b = new byte[1024]; - int r = inp.read(b); - if(r > 0) { - bout.write(b, 0, r); - } else { - going = false; - } - } - - byte[] result = bout.toByteArray(); - assertEquals(fixed, result); - } - - /** - * Checks that we can copy with br tags around the buffer boundaries - */ - public void testBufferSize() throws Exception { - byte[] orig = "

Hello

There!
Tags!

".getBytes("UTF-8"); - byte[] fixed = "

Hello

There!
Tags!

".getBytes("UTF-8"); - - // Vary the buffer size, so that we can end up with the br in the - // overflow or only part in the buffer - for(int i=5; i 0) { - bout.write(b, 0, r); - } else { - going = false; +public final class TestEvilUnclosedBRFixingInputStream { + + static class EvilUnclosedBRFixingInputStream extends ReplacingInputStream { + public EvilUnclosedBRFixingInputStream(byte[] source) { + super(new ByteArrayInputStream(source), "
", "
"); + } + } + + @Test + public void testOK() throws IOException { + byte[] ok = getBytes("

Hello There!
Tags!

"); + + EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(ok); + + assertArrayEquals(ok, IOUtils.toByteArray(inp)); + inp.close(); + } + + @Test + public void testProblem() throws IOException { + byte[] orig = getBytes("

Hello
There!
Tags!

"); + byte[] fixed = getBytes("

Hello
There!
Tags!

"); + + EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(orig); + + assertArrayEquals(fixed, IOUtils.toByteArray(inp)); + inp.close(); + } + + /** + * Checks that we can copy with br tags around the buffer boundaries + */ + @Test + public void testBufferSize() throws IOException { + byte[] orig = getBytes("

Hello

There!
Tags!

"); + byte[] fixed = getBytes("

Hello

There!
Tags!

"); + + // Vary the buffer size, so that we can end up with the br in the + // overflow or only part in the buffer + for(int i=5; i 0) { + bout.write(b, 0, r); + } else { + going = false; + } } - } - - byte[] result = bout.toByteArray(); - assertEquals(fixed, result); - } - } - protected void assertEquals(byte[] a, byte[] b) { - assertEquals(a.length, b.length); - for(int i=0; i + + + + + + + + + + + + 1, 2, 23, 2, 1, 199, 24, 0 + False + False + Risikodaten!$AF$48 + 0 + 0 + 3 + 1 + 1 + 16 + Risikodaten!$AG$44:$AG$47 + 4 + + Single + Normal + Combo + 8 + + + + + +
+ + + + + 20, 14, 15, 2, 21, 1, 16, 5 + False + False + Center + $U$16 + + + + + + +
+ + + + + 20, 14, 11, 0, 20, 37, 12, 4 + False + False + Center + 1 + Risikodaten!E16 + + + + + + + + + 1, 2, 24, 0, 1, 199, 24, 19 + False + False + Antrag!$Y$65 + 0 + 0 + 1 + 1 + 1 + 16 + Antrag!$Z$63:$Z$64 + 2 + + Single + Normal + Combo + 8 + + + + + + + 21, 4, 7, 11, 23, 28, 8, 14 + False + Risikodaten!$AF$22 + 0 + 0 + 0 + 1 + 3 + 16 + Risikodaten!$AG$19:$AG$21 + 2 + + Single + Normal + Combo + 8 + + + + + +
+ + + + + 20, 14, 13, 3, 20, 34, 14, 0 + False + False + Center + 1 + Risikodaten!$J$13 + + + + + + +
+ + + + + 20, 14, 14, 3, 20, 34, 15, 0 + False + False + Center + Risikodaten!$J$14 + + + + + + +
+ + + + + 20, 14, 12, 3, 20, 34, 13, 0 + False + False + Center + 1 + Risikodaten!$J$12 + + + + + + +
+ + + + + 20, 14, 9, 2, 20, 34, 9, 17 + False + False + Center + Risikodaten!$J$9 + + + + + + +
+ + + + + 25, 70, 24, 0, 26, 19, 24, 15 + False + False + Center + Risikodaten!$AD$8 + + + + + + + + 24, 55, 0, 9, 27, 70, 2, 13 + False + Vermittler!$B$2 + Vermittler!$M$6:$N$206 + Pict + + + + + + + +
Ausblenden
+
+
+ + + + 9, 12, 25, 9, 9, 88, 25, 25 + False + False + [0]!Ausblenden_Allianz + Center + Center + + + + + +
Ausblenden
+
+
+ + + + 7, 12, 25, 9, 7, 88, 25, 25 + False + False + [0]!Ausblenden_Generali + Center + Center + + + + + +
Ausblenden
+
+
+ + + + 5, 13, 25, 9, 5, 89, 25, 25 + False + False + [0]!Ausblenden_Donau + Center + Center + + + + + +
Ausblenden
+
+
+ + + + 11, 11, 25, 9, 11, 87, 25, 25 + False + False + [0]!Ausblenden_AragSE + Center + Center + + + + + +
Ausblenden
+
+
+ + + + 13, 12, 25, 9, 13, 88, 25, 25 + False + False + [0]!Ausblenden_HDI + Center + Center + + + + + +
Ausblenden
+
+
+ + + + 15, 12, 25, 9, 15, 88, 25, 25 + False + False + [0]!Ausblenden_Zürich + Center + Center + + + + + +
Ausblenden
+
+
+ + + + 17, 12, 25, 9, 17, 88, 25, 25 + False + False + [0]!Ausblenden_Uniqa + Center + Center + + + + + +
Ausblenden
+
+
+ + + + 3, 11, 25, 4, 3, 85, 25, 19 + False + False + [0]!Ausblenden_VU_bisher + Center + Center + + + + + +
erh.NL
+ + + + + 21, 2, 19, 14, 22, 2, 20, 11 + False + False + Center + 1 + Risikodaten!Y20 + + + + + + +
erh.NL
+ + + + + 22, 2, 19, 14, 22, 68, 20, 11 + False + False + Center + 1 + Risikodaten!Z20 + + + + + + +
erh.NL
+ + + + + 23, 2, 19, 14, 23, 68, 20, 11 + False + False + Center + 1 + Risikodaten!AA20 + + + + + + +
erh.NL
+ + + + + 24, 2, 19, 14, 24, 68, 20, 11 + False + False + Center + 1 + Risikodaten!AB20 + + + + + + +
erh.NL
+ + + + + 25, 2, 19, 14, 25, 68, 20, 11 + False + False + Center + 1 + Risikodaten!AC20 + + + + + + +
erh.NL
+ + + + + 26, 2, 19, 14, 26, 68, 20, 11 + False + False + Center + 1 + Risikodaten!AD20 + + + + + + +
erh.NL
+ + + + + 27, 2, 19, 14, 27, 68, 20, 11 + False + False + Center + 1 + Risikodaten!AE20 + + + + + + + +
+ + + + + 20, 13, 1, 1, 20, 33, 1, 15 + False + False + [0]!Anzeige_Deckung + Center + 1 + Risikodaten!$I$8 + + + + + + + +
+ + + + + 20, 13, 2, 1, 20, 33, 2, 16 + False + False + [0]!Anzeige_Deckung + Center + 1 + Risikodaten!$I22 + + + + + + + +
+ + + + + 20, 13, 3, 1, 20, 33, 3, 16 + False + False + [0]!Anzeige_Deckung + Center + Risikodaten!$I$29 + + + + + + + + + + + + + + + + + + + + + + + + + + 1, 1, 5, 9, 13, 23, 13, 2 + Antrag!$B$7:$K$13 + Pict + + + + + + + + + 1, 2, 0, 1, 13, 23, 3, 10 + $DO$1:$DZ$3 + Pict + + + \ No newline at end of file