add length sanity check for length of embedded OLE10Native (BUG 60256)

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1764927 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java b/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java
index aee6747592cc22fb160ba27d109b948e32eadbe2..d11841dd59e359881bcc63d24ed36b77f7c09da2 100644 (file)
--- a/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java
+++ b/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java
@@ -192,7 +192,10 @@ public class Ole10Native {
             dataSize = totalSize;\r
             break;\r
         }\r
-        \r
+\r
+        if ((long)dataSize + (long)ofs > (long)data.length) { //cast to avoid overflow\r
+            throw new Ole10NativeException("Invalid Ole10Native: declared data length > available data");\r
+        }\r
         dataBuffer = new byte[dataSize];\r
         System.arraycopy(data, ofs, dataBuffer, 0, dataSize);\r
         ofs += dataSize;\r

diff --git a/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java b/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java
index a8826ffad0050e28ef2bdacfe862b65f3fc9e246..0abdf8489cb919b5eb1708b17f390b274638a538 100644 (file)
--- a/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java
+++ b/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java
@@ -20,6 +20,8 @@ package org.apache.poi.poifs.filesystem;
 import static org.hamcrest.core.IsEqual.equalTo;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertThat;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 import java.io.ByteArrayOutputStream;
 import java.io.File;
@@ -110,10 +112,14 @@ public class TestOle10Native {
     }
 
     @Test
-    @Ignore("BUG 60256")
     public void testOleNativeOOM() throws IOException, Ole10NativeException {
         POIFSFileSystem fs = new POIFSFileSystem(dataSamples.openResourceAsStream("60256.bin"));
-        Ole10Native ole = Ole10Native.createFromEmbeddedOleObject(fs);
+        try {
+            Ole10Native.createFromEmbeddedOleObject(fs);
+            fail("Should have thrown exception because OLENative lacks a length parameter");
+        } catch (Ole10NativeException e) {
+            assertTrue(e.getMessage().indexOf("declared data length") > -1);
+        }
     }
 
 }