If the apparent location of the current user atom is past the end of the data, then...

git-svn-id: https://svn.apache.org/repos/asf/jakarta/poi/trunk@539453 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/scratchpad/src/org/apache/poi/hslf/EncryptedSlideShow.java b/src/scratchpad/src/org/apache/poi/hslf/EncryptedSlideShow.java
index 67d6dc9f71b27a5b4107a8e1e3fa9399a09b43e9..2b92b848d248d2d5ea97c2eaf2dc7cabfb963246 100644 (file)
--- a/src/scratchpad/src/org/apache/poi/hslf/EncryptedSlideShow.java
+++ b/src/scratchpad/src/org/apache/poi/hslf/EncryptedSlideShow.java
@@ -22,6 +22,7 @@ package org.apache.poi.hslf;
 
 import java.io.FileNotFoundException;
 
+import org.apache.poi.hslf.exceptions.CorruptPowerPointFileException;
 import org.apache.poi.hslf.record.CurrentUserAtom;
 import org.apache.poi.hslf.record.DocumentEncryptionAtom;
 import org.apache.poi.hslf.record.PersistPtrHolder;
@@ -84,6 +85,11 @@ public class EncryptedSlideShow
                
                CurrentUserAtom cua = hss.getCurrentUserAtom();
                if(cua.getCurrentEditOffset() != 0) {
+                       // Check it's not past the end of the file
+                       if(cua.getCurrentEditOffset() > hss.getUnderlyingBytes().length) {
+                               throw new CorruptPowerPointFileException("The CurrentUserAtom claims that the offset of last edit details are past the end of the file");
+                       }
+                       
                        // Grab the details of the UserEditAtom there
                        Record r = Record.buildRecordAtOffset(
                                        hss.getUnderlyingBytes(),