Better handling of zero sized images, and where the picture stream doesn't have enoug...

git-svn-id: https://svn.apache.org/repos/asf/jakarta/poi/trunk@413658 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/scratchpad/src/org/apache/poi/hslf/HSLFSlideShow.java b/src/scratchpad/src/org/apache/poi/hslf/HSLFSlideShow.java
index e410f2caf35c0cf2eef39ce398794ea8664f873a..966ebe7fd45fb872ae4830f93b031dcd50cfb9fa 100644 (file)
--- a/src/scratchpad/src/org/apache/poi/hslf/HSLFSlideShow.java
+++ b/src/scratchpad/src/org/apache/poi/hslf/HSLFSlideShow.java
@@ -219,7 +219,7 @@ public class HSLFSlideShow extends POIDocument
 
                ArrayList p = new ArrayList();
                int pos = 0; 
-               while (pos < pictstream.length) {
+               while (pos < (pictstream.length - PictureData.HEADER_SIZE)) {
                        PictureData pict = new PictureData(pictstream, pos);
                        p.add(pict);
                        pos += PictureData.HEADER_SIZE + pict.getSize();

diff --git a/src/scratchpad/src/org/apache/poi/hslf/usermodel/PictureData.java b/src/scratchpad/src/org/apache/poi/hslf/usermodel/PictureData.java
index 2f37b72df6656bbb82c385f24182372615fe9a3c..f040be4859c71abbe459f38afcc38c9c7817aaf2 100644 (file)
--- a/src/scratchpad/src/org/apache/poi/hslf/usermodel/PictureData.java
+++ b/src/scratchpad/src/org/apache/poi/hslf/usermodel/PictureData.java
@@ -63,9 +63,20 @@ public class PictureData {
                header = new byte[PictureData.HEADER_SIZE];\r
                System.arraycopy(pictstream, offset, header, 0, header.length);\r
 \r
-               int size = LittleEndian.getInt(header, 4) - 17;\r
+               // Get the size of the picture, and make sure it's sane\r
+               // Size is stored unsigned, since it must always be positive\r
+               int size = (int)LittleEndian.getUInt(header, 4) - 17;\r
+               int startPos = offset + PictureData.HEADER_SIZE;\r
+               if(size < 0) { size = 0; }\r
+               if(size > (pictstream.length - startPos)) { \r
+                       int remaining = pictstream.length - startPos;\r
+                       System.err.println("Warning: PictureData claimed picture was of length " + size + ", but only " + remaining + " remained!");\r
+                       size = remaining;\r
+               }\r
+\r
+               // Save the picture data\r
                pictdata = new byte[size];\r
-               System.arraycopy(pictstream, offset + PictureData.HEADER_SIZE, pictdata, 0, pictdata.length);\r
+               System.arraycopy(pictstream, startPos, pictdata, 0, pictdata.length);\r
        }\r
 \r
        /**\r