Apache
/
poi
mirror of https://github.com/apache/poi.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug 60906 -- clean up, and add range checking for casting to ints. 

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1788295 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Tim Allison 2017-03-23 18:08:52 +00:00
parent 93c7f9bded
commit edcfb84ac5
3 changed files with 18 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/ooxml/java/org/apache/poi/xssf/binary/XSSFBCellHeader.java
View File

@ -39,11 +39,11 @@ class XSSFBCellHeader {
* @param cell cell buffer to update
*/
public static void parse(byte[] data, int offset, int currentRow, XSSFBCellHeader cell) {
long colNum = LittleEndian.getUInt(data, offset); offset += LittleEndian.INT_SIZE;
int colNum = XSSFBUtils.castToInt(LittleEndian.getUInt(data, offset)); offset += LittleEndian.INT_SIZE;
int styleIdx = XSSFBUtils.get24BitInt(data, offset); offset += 3;
//TODO: range checking
boolean showPhonetic = false;//TODO: fill this out
cell.reset(currentRow, (int)colNum, styleIdx, showPhonetic);
cell.reset(currentRow, colNum, styleIdx, showPhonetic);
}
private int rowNum;

4
src/ooxml/java/org/apache/poi/xssf/binary/XSSFBSharedStringsTable.java
View File

@ -133,8 +133,8 @@ public class XSSFBSharedStringsTable {
strings.add(rstr.getString());
break;
case BrtBeginSst:
count = (int) LittleEndian.getUInt(data,0);
uniqueCount = (int) LittleEndian.getUInt(data, 4);
count = XSSFBUtils.castToInt(LittleEndian.getUInt(data,0));
uniqueCount = XSSFBUtils.castToInt(LittleEndian.getUInt(data, 4));
break;
}

31
src/ooxml/java/org/apache/poi/xssf/binary/XSSFBSheetHandler.java
View File

@ -74,11 +74,11 @@ public class XSSFBSheetHandler extends XSSFBParser {
switch(type) {
case BrtRowHdr:
long rw = LittleEndian.getUInt(data, 0);
if (rw > 0x00100000L) {//could make sure this is larger than currentRow, according to spec?
int rw = XSSFBUtils.castToInt(LittleEndian.getUInt(data, 0));
if (rw > 0x00100000) {//could make sure this is larger than currentRow, according to spec?
throw new XSSFBParseException("Row number beyond allowable range: "+rw);
}
currentRow = (int)rw;
currentRow = rw;
checkMissedComments(currentRow);
startRow(currentRow);
break;
@ -142,9 +142,7 @@ public class XSSFBSheetHandler extends XSSFBParser {
beforeCellValue(data);
//xNum
double val = LittleEndian.getDouble(data, XSSFBCellHeader.length);
String formatString = styles.getNumberFormatString(cellBuffer.getStyleIdx());
String formattedVal = dataFormatter.formatRawCellContents(val, cellBuffer.getStyleIdx(), formatString);
handleCellValue(formattedVal);
handleCellValue(formatVal(val, cellBuffer.getStyleIdx()));
}
private void handleCellSt(byte[] data) {
@ -183,26 +181,25 @@ public class XSSFBSheetHandler extends XSSFBParser {
beforeCellValue(data);
//xNum
double val = LittleEndian.getDouble(data, XSSFBCellHeader.length);
String formatString = styles.getNumberFormatString(cellBuffer.getStyleIdx());
String formattedVal = dataFormatter.formatRawCellContents(val, cellBuffer.getStyleIdx(), formatString);
handleCellValue(formattedVal);
handleCellValue(formatVal(val, cellBuffer.getStyleIdx()));
}
private void handleCellRk(byte[] data) {
beforeCellValue(data);
double val = rkNumber(data, XSSFBCellHeader.length);
String formatString = styles.getNumberFormatString(cellBuffer.getStyleIdx());
short styleIndex = styles.getNumberFormatIndex(cellBuffer.getStyleIdx());
String formattedVal = dataFormatter.formatRawCellContents(val, styleIndex, formatString);
handleCellValue(formattedVal);
handleCellValue(formatVal(val, cellBuffer.getStyleIdx()));
}
private String formatVal(double val, int styleIdx) {
String formatString = styles.getNumberFormatString(styleIdx);
short styleIndex = styles.getNumberFormatIndex(styleIdx);
return dataFormatter.formatRawCellContents(val, styleIndex, formatString);
}
private void handleBrtCellIsst(byte[] data) {
beforeCellValue(data);
long idx = LittleEndian.getUInt(data, XSSFBCellHeader.length);
//check for out of range, buffer overflow
XSSFRichTextString rtss = new XSSFRichTextString(stringsTable.getEntryAt((int)idx));
int idx = XSSFBUtils.castToInt(LittleEndian.getUInt(data, XSSFBCellHeader.length));
XSSFRichTextString rtss = new XSSFRichTextString(stringsTable.getEntryAt(idx));
handleCellValue(rtss.getString());
}