#60626 - ArrayIndexOutOfBoundsException in EvilUnclosedBRFixingInputStream

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1782095 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/legal/LICENSE b/legal/LICENSE
index 19246db04cbb9ec4a4606a8cc7b4fba64e6143c8..3b63d08dd5ee50324fd0f6a35c2550b6d75d87c6 100644 (file)
--- a/legal/LICENSE
+++ b/legal/LICENSE
@@ -510,4 +510,28 @@ SLF4J library (slf4j-api-*.jar)
     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
     LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
     OF CONTRACT, TORT OR OTHERWISE,  ARISING FROM, OUT OF OR IN CONNECTION
-    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
\ No newline at end of file
+    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+inbot-utils (https://github.com/Inbot/inbot-utils)
+
+       The MIT License (MIT)
+       
+       Copyright (c) 2015 Inbot
+       
+       Permission is hereby granted, free of charge, to any person obtaining a copy
+       of this software and associated documentation files (the "Software"), to deal
+       in the Software without restriction, including without limitation the rights
+       to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+       copies of the Software, and to permit persons to whom the Software is
+       furnished to do so, subject to the following conditions:
+       
+       The above copyright notice and this permission notice shall be included in all
+       copies or substantial portions of the Software.
+       
+       THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+       IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+       FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+       AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+       LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+       OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+       SOFTWARE.
\ No newline at end of file

diff --git a/src/java/org/apache/poi/util/ReplacingInputStream.java b/src/java/org/apache/poi/util/ReplacingInputStream.java
new file mode 100644 (file)
index 0000000..1b5430e
--- /dev/null
+++ b/src/java/org/apache/poi/util/ReplacingInputStream.java
@@ -0,0 +1,204 @@
+/* ====================================================================
+   Licensed to the Apache Software Foundation (ASF) under one or more
+   contributor license agreements.  See the NOTICE file distributed with
+   this work for additional information regarding copyright ownership.
+   The ASF licenses this file to You under the Apache License, Version 2.0
+   (the "License"); you may not use this file except in compliance with
+   the License.  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+==================================================================== */
+
+package org.apache.poi.util;
+
+import java.io.FilterInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.Charset;
+import java.util.Arrays;
+
+/**
+ * Simple FilterInputStream that can replace occurrences of bytes with something else.
+ *
+ * This has been taken from inbot-utils. (MIT licensed)
+ *
+ * @see <a href="https://github.com/Inbot/inbot-utils">inbot-utils</a>
+ */
+@Internal
+public class ReplacingInputStream extends FilterInputStream {
+
+    // while matching, this is where the bytes go.
+    final int[] buf;
+    private int matchedIndex=0;
+    private int unbufferIndex=0;
+    private int replacedIndex=0;
+
+    private final byte[] pattern;
+    private final byte[] replacement;
+    private State state=State.NOT_MATCHED;
+
+    // simple state machine for keeping track of what we are doing
+    private enum State {
+        NOT_MATCHED,
+        MATCHING,
+        REPLACING,
+        UNBUFFER
+    }
+
+    private static final Charset UTF8 = Charset.forName("UTF-8");
+
+    /**
+     * Replace occurrences of pattern in the input. Note: input is assumed to be UTF-8 encoded. If not the case use byte[] based pattern and replacement.
+     * @param in input
+     * @param pattern pattern to replace.
+     * @param replacement the replacement or null
+     */
+    public ReplacingInputStream(InputStream in, String pattern, String replacement) {
+        this(in, pattern.getBytes(UTF8), replacement==null ? null : replacement.getBytes(UTF8));
+    }
+
+    /**
+     * Replace occurrences of pattern in the input.<p>
+     *
+     * If you want to normalize line endings DOS/MAC (\n\r | \r) to UNIX (\n), you can call the following:<br/>
+     * {@code new ReplacingInputStream(new ReplacingInputStream(is, "\n\r", "\n"), "\r", "\n")}
+     *
+     * @param in input
+     * @param pattern pattern to replace
+     * @param replacement the replacement or null
+     */
+    public ReplacingInputStream(InputStream in, byte[] pattern, byte[] replacement) {
+        super(in);
+        if (pattern == null || pattern.length == 0) {
+            throw new IllegalArgumentException("pattern length should be > 0");
+        }
+        this.pattern = pattern;
+        this.replacement = replacement;
+        // we will never match more than the pattern length
+        buf = new int[pattern.length];
+    }
+
+    @Override
+    public int read(byte[] b, int off, int len) throws IOException {
+        // copy of parent logic; we need to call our own read() instead of super.read(), which delegates instead of calling our read
+        if (b == null) {
+            throw new NullPointerException();
+        } else if (off < 0 || len < 0 || len > b.length - off) {
+            throw new IndexOutOfBoundsException();
+        } else if (len == 0) {
+            return 0;
+        }
+
+        int c = read();
+        if (c == -1) {
+            return -1;
+        }
+        b[off] = (byte)c;
+
+        int i = 1;
+        for (; i < len ; i++) {
+            c = read();
+            if (c == -1) {
+                break;
+            }
+            b[off + i] = (byte)c;
+        }
+        return i;
+
+    }
+
+    @Override
+    public int read(byte[] b) throws IOException {
+        // call our own read
+        return read(b, 0, b.length);
+    }
+
+    @Override
+    public int read() throws IOException {
+        // use a simple state machine to figure out what we are doing
+        int next;
+        switch (state) {
+        default:
+        case NOT_MATCHED:
+            // we are not currently matching, replacing, or unbuffering
+            next=super.read();
+            if (pattern[0] != next) {
+                return next;
+            }
+
+            // clear whatever was there
+            Arrays.fill(buf, 0);
+            // make sure we start at 0
+            matchedIndex=0;
+
+            buf[matchedIndex++]=next;
+            if (pattern.length == 1) {
+                // edge-case when the pattern length is 1 we go straight to replacing
+                state=State.REPLACING;
+                // reset replace counter
+                replacedIndex=0;
+            } else {
+                // pattern of length 1
+                state=State.MATCHING;
+            }
+            // recurse to continue matching
+            return read();
+
+        case MATCHING:
+            // the previous bytes matched part of the pattern
+            next=super.read();
+            if (pattern[matchedIndex]==next) {
+                buf[matchedIndex++]=next;
+                if (matchedIndex==pattern.length) {
+                    // we've found a full match!
+                    if (replacement==null || replacement.length==0) {
+                        // the replacement is empty, go straight to NOT_MATCHED
+                        state=State.NOT_MATCHED;
+                        matchedIndex=0;
+                    } else {
+                        // start replacing
+                        state=State.REPLACING;
+                        replacedIndex=0;
+                    }
+                }
+            } else {
+                // mismatch -> unbuffer
+                buf[matchedIndex++]=next;
+                state=State.UNBUFFER;
+                unbufferIndex=0;
+            }
+            return read();
+
+        case REPLACING:
+            // we've fully matched the pattern and are returning bytes from the replacement
+            next=replacement[replacedIndex++];
+            if (replacedIndex==replacement.length) {
+                state=State.NOT_MATCHED;
+                replacedIndex=0;
+            }
+            return next;
+
+        case UNBUFFER:
+            // we partially matched the pattern before encountering a non matching byte
+            // we need to serve up the buffered bytes before we go back to NOT_MATCHED
+            next=buf[unbufferIndex++];
+            if (unbufferIndex==matchedIndex) {
+                state=State.NOT_MATCHED;
+                matchedIndex=0;
+            }
+            return next;
+        }
+    }
+
+    @Override
+    public String toString() {
+        return state.name() + " " + matchedIndex + " " + replacedIndex + " " + unbufferIndex;
+    }
+
+}
\ No newline at end of file

diff --git a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java
index 352b804b9a8f4bcd1652c4f8833d40f1437b1497..7a7f02f6cd5fc863b0ecf2b18d7d31ff27c54f1a 100644 (file)
--- a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java
+++ b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFVMLDrawing.java
@@ -34,7 +34,7 @@ import javax.xml.namespace.QName;
 import org.apache.poi.POIXMLDocumentPart;
 import org.apache.poi.openxml4j.opc.PackagePart;
 import org.apache.poi.util.DocumentHelper;
-import org.apache.poi.xssf.util.EvilUnclosedBRFixingInputStream;
+import org.apache.poi.util.ReplacingInputStream;
 import org.apache.xmlbeans.XmlCursor;
 import org.apache.xmlbeans.XmlException;
 import org.apache.xmlbeans.XmlObject;
@@ -124,7 +124,13 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart {
     protected void read(InputStream is) throws IOException, XmlException {
         Document doc;
         try {
-            doc = DocumentHelper.readDocument(new EvilUnclosedBRFixingInputStream(is));
+            /*
+             * This is a seriously sick fix for the fact that some .xlsx files contain raw bits
+             * of HTML, without being escaped or properly turned into XML.
+             * The result is that they contain things like >br<, which breaks the XML parsing.
+             * This very sick InputStream wrapper attempts to spot these go past, and fix them.
+             */
+            doc = DocumentHelper.readDocument(new ReplacingInputStream(is, "<br>", "<br/>"));
         } catch (SAXException e) {
             throw new XmlException(e.getMessage(), e);
         }
@@ -146,7 +152,9 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart {
                 String id = shape.getId();
                 if(id != null) {
                     Matcher m = ptrn_shapeId.matcher(id);
-                    if(m.find()) _shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1)));
+                    if(m.find()) {
+                        _shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1)));
+                    }
                 }
                 _items.add(shape);
             } else {

diff --git a/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java b/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java
index 5fae1ea1c68566ebee8f1045b957684c6b2aec54..0ef1aeeb5eaffc953ad9379c6a79453ad1e7a1ff 100644 (file)
--- a/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java
+++ b/src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java
@@ -16,9 +16,11 @@
 ==================================================================== */
 package org.apache.poi.xssf.util;
 
-import java.io.IOException;
 import java.io.InputStream;
-import java.util.ArrayList;
+
+import org.apache.poi.util.Internal;
+import org.apache.poi.util.Removal;
+import org.apache.poi.util.ReplacingInputStream;
 
 /**
  * This is a seriously sick fix for the fact that some .xlsx
@@ -31,179 +33,14 @@ import java.util.ArrayList;
  * Only works for UTF-8 and US-ASCII based streams!
  * It should only be used where experience shows the problem
  *  can occur...
+ *  
+ *  @deprecated 3.16-beta2 - use ReplacingInputStream(source, ">br<", ">br/<")
  */
-public class EvilUnclosedBRFixingInputStream extends InputStream {
-   private InputStream source;
-   private byte[] spare;
-   
-   private static byte[] detect = new byte[] {
-      (byte)'<', (byte)'b', (byte)'r', (byte)'>'
-   };
-   
+@Deprecated
+@Removal(version="3.18")
+@Internal
+public class EvilUnclosedBRFixingInputStream extends ReplacingInputStream {
    public EvilUnclosedBRFixingInputStream(InputStream source) {
-      this.source = source;
-   }
-
-   /**
-    * Warning - doesn't fix!
-    */
-   @Override
-   public int read() throws IOException {
-      return source.read();
-   }
-
-   @Override
-   public int read(byte[] b, int off, int len) throws IOException {
-      // Grab any data left from last time
-      int readA = readFromSpare(b, off, len);
-
-      // Now read from the stream 
-      int readB = source.read(b, off+readA, len-readA);
-      
-      // Figure out how much we've done
-      int read;
-      if(readB == -1 || readB == 0) {
-          if (readA == 0) {
-              return readB;
-          }
-         read = readA; 
-      } else {
-         read = readA + readB;
-      }
-      
-      // Fix up our data
-      if(read > 0) {
-         read = fixUp(b, off, read);
-      }
-      
-      // All done
-      return read;
-   }
-
-   @Override
-   public int read(byte[] b) throws IOException {
-      return this.read(b, 0, b.length);
-   }
-   
-   /**
-    * Reads into the buffer from the spare bytes
-    */
-   private int readFromSpare(byte[] b, int offset, int len) {
-      if(spare == null) return 0;
-      if(len == 0) throw new IllegalArgumentException("Asked to read 0 bytes");
-      
-      if(spare.length <= len) {
-         // All fits, good
-         System.arraycopy(spare, 0, b, offset, spare.length);
-         int read = spare.length;
-         spare = null;
-         return read;
-      } else {
-         // We have more spare than they can copy with...
-         byte[] newspare = new byte[spare.length-len];
-         System.arraycopy(spare, 0, b, offset, len);
-         System.arraycopy(spare, len, newspare, 0, newspare.length);
-         spare = newspare;
-         return len;
-      }
-   }
-   private void addToSpare(byte[] b, int offset, int len, boolean atTheEnd) {
-      if(spare == null) {
-         spare = new byte[len];
-         System.arraycopy(b, offset, spare, 0, len);
-      } else {
-         byte[] newspare = new byte[spare.length+len];
-         if(atTheEnd) {
-            System.arraycopy(spare, 0, newspare, 0, spare.length);
-            System.arraycopy(b, offset, newspare, spare.length, len);
-         } else {
-            System.arraycopy(b, offset, newspare, 0, len);
-            System.arraycopy(spare, 0, newspare, len, spare.length);
-         }
-         spare = newspare;
-      }
-   }
-
-   private int fixUp(byte[] b, int offset, int read) {
-      // Do we have any potential overhanging ones?
-      for(int i=0; i<detect.length-1; i++) {
-         int base = offset+read-1-i;
-         if(base < 0) continue;
-            
-         boolean going = true;
-         for(int j=0; j<=i && going; j++) {
-            if(b[base+j] == detect[j]) {
-               // Matches
-            } else {
-               going = false;
-            }
-         }
-         if(going) {
-            // There could be a <br> handing over the end, eg <br|
-            addToSpare(b, base, i+1, true);
-            read -= 1;
-            read -= i;
-            break;
-         }
-      }
-      
-      // Find places to fix
-      ArrayList<Integer> fixAt = new ArrayList<Integer>();
-      for(int i=offset; i<=offset+read-detect.length; i++) {
-         boolean going = true;
-         for(int j=0; j<detect.length && going; j++) {
-            if(b[i+j] != detect[j]) {
-               going = false;
-            }
-         }
-         if(going) {
-            fixAt.add(i);
-         }
-      }
-      
-      if(fixAt.size()==0) {
-         return read;
-      }
-      
-      // If there isn't space in the buffer to contain
-      //  all the fixes, then save the overshoot for next time
-      int needed = offset+read+fixAt.size();
-      int overshoot = needed - b.length;  
-      if(overshoot > 0) {
-         // Make sure we don't loose part of a <br>!
-         int fixes = 0;
-         for(int at : fixAt) {
-            if(at > offset+read-detect.length-overshoot-fixes) {
-               overshoot = needed - at - 1 - fixes;
-               break;
-            }
-            fixes++;
-         }
-
-         addToSpare(b, offset+read-overshoot, overshoot, false);
-         read -= overshoot;
-      }
-      
-      // Fix them, in reverse order so the
-      //  positions are valid
-      for(int j=fixAt.size()-1; j>=0; j--) {
-         int i = fixAt.get(j);
-         if(i >= read+offset) {
-            // This one has moved into the overshoot
-            continue;
-         }
-         if(i > read-3) {
-            // This one has moved into the overshoot
-            continue;
-         }
-
-         byte[] tmp = new byte[read-i-3];
-         System.arraycopy(b, i+3, tmp, 0, tmp.length);
-         b[i+3] = (byte)'/';
-         System.arraycopy(tmp, 0, b, i+4, tmp.length);
-         // It got one longer
-         read++;
-      }
-      return read;
+      super(source, "<br>", "<br/>");
    }
 }

diff --git a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java
index 4ae2b8b052263801b6cb0ad69208030ab85962c0..b8dbd36a712f94e9f25f10cb7b3d0b0ca160dfca 100644 (file)
--- a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java
+++ b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java
@@ -16,18 +16,28 @@
 ==================================================================== */
 package org.apache.poi.xssf.usermodel;
 
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
+import java.io.IOException;
 import java.io.InputStream;
 import java.math.BigInteger;
 import java.util.List;
+import java.util.regex.Pattern;
 
-import com.microsoft.schemas.office.excel.STTrueFalseBlank;
 import org.apache.poi.POIDataSamples;
+import org.apache.xmlbeans.XmlException;
 import org.apache.xmlbeans.XmlObject;
+import org.junit.Test;
 
 import com.microsoft.schemas.office.excel.CTClientData;
 import com.microsoft.schemas.office.excel.STObjectType;
+import com.microsoft.schemas.office.excel.STTrueFalseBlank;
 import com.microsoft.schemas.office.office.CTShapeLayout;
 import com.microsoft.schemas.office.office.STConnectType;
 import com.microsoft.schemas.office.office.STInsetMode;
@@ -37,14 +47,10 @@ import com.microsoft.schemas.vml.CTShapetype;
 import com.microsoft.schemas.vml.STExt;
 import com.microsoft.schemas.vml.STTrueFalse;
 
-import junit.framework.TestCase;
-
-/**
- * @author Yegor Kozlov
- */
-public class TestXSSFVMLDrawing extends TestCase {
+public class TestXSSFVMLDrawing {
 
-    public void testNew() throws Exception {
+    @Test
+    public void testNew() throws IOException, XmlException {
         XSSFVMLDrawing vml = new XSSFVMLDrawing();
         List<XmlObject> items = vml.getItems();
         assertEquals(2, items.size());
@@ -57,7 +63,7 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertTrue(items.get(1) instanceof CTShapetype);
         CTShapetype type = (CTShapetype)items.get(1);
         assertEquals("21600,21600", type.getCoordsize());
-        assertEquals(202.0f, type.getSpt());
+        assertEquals(202.0f, type.getSpt(), 0);
         assertEquals("m,l,21600r21600,l21600,xe", type.getPath2());
         assertEquals("_x0000_t202", type.getId());
         assertEquals(STTrueFalse.T, type.getPathArray(0).getGradientshapeok());
@@ -102,7 +108,8 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertTrue(items2.get(2) instanceof CTShape);
     }
 
-    public void testFindCommentShape() throws Exception {
+    @Test
+    public void testFindCommentShape() throws IOException, XmlException {
         
         XSSFVMLDrawing vml = new XSSFVMLDrawing();
         InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml");
@@ -140,7 +147,8 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertSame(sh_a1, newVml.findCommentShape(0, 1));
     }
 
-    public void testRemoveCommentShape() throws Exception {
+    @Test
+    public void testRemoveCommentShape() throws IOException, XmlException {
         XSSFVMLDrawing vml = new XSSFVMLDrawing();
         InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml");
         try {
@@ -156,4 +164,22 @@ public class TestXSSFVMLDrawing extends TestCase {
         assertNull(vml.findCommentShape(0, 0));
 
     }
+    
+    @Test
+    public void testEvilUnclosedBRFixing() throws IOException, XmlException {
+        XSSFVMLDrawing vml = new XSSFVMLDrawing();
+        InputStream stream = POIDataSamples.getOpenXML4JInstance().openResourceAsStream("bug-60626.vml");
+        try {
+            vml.read(stream);
+        } finally {
+            stream.close();
+        }
+        Pattern p = Pattern.compile("<br/>");
+        int count = 0;
+        for (XmlObject xo : vml.getItems()) {
+            String split[] = p.split(xo.toString());
+            count += split.length-1;
+        }
+        assertEquals(16, count);
+    }
 }
\ No newline at end of file

diff --git a/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java b/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java
index a15b22c1c1098ed81c89562d7c2aff4601e55f6e..d9010fbbc2ef50e072c6158f4b73a23dbfc645ff 100644 (file)
--- a/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java
+++ b/src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java
@@ -17,94 +17,78 @@
 
 package org.apache.poi.xssf.util;
 
+import static org.junit.Assert.assertArrayEquals;
+
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.charset.Charset;
+
+import org.apache.poi.util.IOUtils;
+import org.apache.poi.util.ReplacingInputStream;
+import org.junit.Test;
+
+public final class TestEvilUnclosedBRFixingInputStream {
+
+    static class EvilUnclosedBRFixingInputStream extends ReplacingInputStream {
+        public EvilUnclosedBRFixingInputStream(byte[] source) {
+            super(new ByteArrayInputStream(source), "<br>", "<br/>");
+        }
+    }
+
+    @Test
+    public void testOK() throws IOException {
+        byte[] ok = getBytes("<p><div>Hello There!</div> <div>Tags!</div></p>");
+
+        EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(ok);
+
+        assertArrayEquals(ok, IOUtils.toByteArray(inp));
+        inp.close();
+    }
 
-import junit.framework.TestCase;
-
-public final class TestEvilUnclosedBRFixingInputStream extends TestCase {
-   public void testOK() throws Exception {
-      byte[] ok = "<p><div>Hello There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
-      
-      EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
-            new ByteArrayInputStream(ok)
-      );
-      
-      ByteArrayOutputStream bout = new ByteArrayOutputStream();
-      boolean going = true;
-      while(going) {
-         byte[] b = new byte[1024];
-         int r = inp.read(b);
-         if(r > 0) {
-            bout.write(b, 0, r);
-         } else {
-            going = false;
-         }
-      }
-      
-      byte[] result = bout.toByteArray();
-      assertEquals(ok, result);
-   }
-   
-   public void testProblem() throws Exception {
-      byte[] orig = "<p><div>Hello<br>There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
-      byte[] fixed = "<p><div>Hello<br/>There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
-      
-      EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
-            new ByteArrayInputStream(orig)
-      );
-      
-      ByteArrayOutputStream bout = new ByteArrayOutputStream();
-      boolean going = true;
-      while(going) {
-         byte[] b = new byte[1024];
-         int r = inp.read(b);
-         if(r > 0) {
-            bout.write(b, 0, r);
-         } else {
-            going = false;
-         }
-      }
-      
-      byte[] result = bout.toByteArray();
-      assertEquals(fixed, result);
-   }
-   
-   /**
-    * Checks that we can copy with br tags around the buffer boundaries
-    */
-   public void testBufferSize() throws Exception {
-      byte[] orig = "<p><div>Hello<br> <br>There!</div> <div>Tags!<br><br></div></p>".getBytes("UTF-8");
-      byte[] fixed = "<p><div>Hello<br/> <br/>There!</div> <div>Tags!<br/><br/></div></p>".getBytes("UTF-8");
-      
-      // Vary the buffer size, so that we can end up with the br in the
-      //  overflow or only part in the buffer
-      for(int i=5; i<orig.length; i++) {
-         EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
-               new ByteArrayInputStream(orig)
-         );
-         
-         ByteArrayOutputStream bout = new ByteArrayOutputStream();
-         boolean going = true;
-         while(going) {
-            byte[] b = new byte[i];
-            int r = inp.read(b);
-            if(r > 0) {
-               bout.write(b, 0, r);
-            } else {
-               going = false;
+    @Test
+    public void testProblem() throws IOException {
+        byte[] orig = getBytes("<p><div>Hello<br>There!</div> <div>Tags!</div></p>");
+        byte[] fixed = getBytes("<p><div>Hello<br/>There!</div> <div>Tags!</div></p>");
+
+        EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(orig);
+
+        assertArrayEquals(fixed, IOUtils.toByteArray(inp));
+        inp.close();
+    }
+
+    /**
+     * Checks that we can copy with br tags around the buffer boundaries
+     */
+    @Test
+    public void testBufferSize() throws IOException {
+        byte[] orig = getBytes("<p><div>Hello<br> <br>There!</div> <div>Tags!<br><br></div></p>");
+        byte[] fixed = getBytes("<p><div>Hello<br/> <br/>There!</div> <div>Tags!<br/><br/></div></p>");
+
+        // Vary the buffer size, so that we can end up with the br in the
+        //  overflow or only part in the buffer
+        for(int i=5; i<orig.length; i++) {
+            EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(orig);
+
+            ByteArrayOutputStream bout = new ByteArrayOutputStream();
+            boolean going = true;
+            while(going) {
+                byte[] b = new byte[i];
+                int r = inp.read(b);
+                if(r > 0) {
+                    bout.write(b, 0, r);
+                } else {
+                    going = false;
+                }
             }
-         }
-         
-         byte[] result = bout.toByteArray();
-         assertEquals(fixed, result);
-      }
-   }
-
-   protected void assertEquals(byte[] a, byte[] b) {
-      assertEquals(a.length, b.length);
-      for(int i=0; i<a.length; i++) {
-         assertEquals("Wrong byte at index " + i, a[i], b[i]);
-      }
-   }
+
+            byte[] result = bout.toByteArray();
+            assertArrayEquals(fixed, result);
+            inp.close();
+        }
+    }
+
+    private static byte[] getBytes(String str) {
+        return str.getBytes(Charset.forName("UTF-8"));
+    }
 }

diff --git a/test-data/openxml4j/bug-60626.vml b/test-data/openxml4j/bug-60626.vml
new file mode 100644 (file)
index 0000000..c5fb390
--- /dev/null
+++ b/test-data/openxml4j/bug-60626.vml
@@ -0,0 +1,658 @@
+<xml xmlns:v="urn:schemas-microsoft-com:vml"\r
+ xmlns:o="urn:schemas-microsoft-com:office:office"\r
+ xmlns:x="urn:schemas-microsoft-com:office:excel">\r
+ <o:shapelayout v:ext="edit">\r
+  <o:idmap v:ext="edit" data="46,98,145,186,227"/>\r
+ </o:shapelayout><v:shapetype id="_x0000_t201" coordsize="21600,21600" o:spt="201"\r
+  path="m,l,21600r21600,l21600,xe">\r
+  <v:stroke joinstyle="miter"/>\r
+  <v:path shadowok="f" o:extrusionok="f" strokeok="f" fillok="f" o:connecttype="rect"/>\r
+  <o:lock v:ext="edit" shapetype="t"/>\r
+ </v:shapetype><v:shape id="_x0000_s47105" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:15pt;margin-top:323.25pt;width:147.75pt;height:13.5pt;z-index:1;\r
+  mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <o:lock v:ext="edit" rotation="t" text="t"/>\r
+  <x:ClientData ObjectType="Drop">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    1, 2, 23, 2, 1, 199, 24, 0</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:FmlaLink>Risikodaten!$AF$48</x:FmlaLink>\r
+   <x:Val>0</x:Val>\r
+   <x:Min>0</x:Min>\r
+   <x:Max>3</x:Max>\r
+   <x:Inc>1</x:Inc>\r
+   <x:Page>1</x:Page>\r
+   <x:Dx>16</x:Dx>\r
+   <x:FmlaRange>Risikodaten!$AG$44:$AG$47</x:FmlaRange>\r
+   <x:Sel>4</x:Sel>\r
+   <x:NoThreeD2/>\r
+   <x:SelType>Single</x:SelType>\r
+   <x:LCT>Normal</x:LCT>\r
+   <x:DropStyle>Combo</x:DropStyle>\r
+   <x:DropLines>8</x:DropLines>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s47106" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:971.25pt;margin-top:203.25pt;width:21pt;height:17.25pt;z-index:2;\r
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 14, 15, 2, 21, 1, 16, 5</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:FmlaLink>$U$16</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s47123" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:971.25pt;margin-top:147.75pt;width:17.25pt;height:16.5pt;\r
+  z-index:3;mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 14, 11, 0, 20, 37, 12, 4</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!E16</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s47124" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:15pt;margin-top:336.75pt;width:147.75pt;height:14.25pt;z-index:4;\r
+  mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t" text="t"/>\r
+  <x:ClientData ObjectType="Drop">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    1, 2, 24, 0, 1, 199, 24, 19</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:FmlaLink>Antrag!$Y$65</x:FmlaLink>\r
+   <x:Val>0</x:Val>\r
+   <x:Min>0</x:Min>\r
+   <x:Max>1</x:Max>\r
+   <x:Inc>1</x:Inc>\r
+   <x:Page>1</x:Page>\r
+   <x:Dx>16</x:Dx>\r
+   <x:FmlaRange>Antrag!$Z$63:$Z$64</x:FmlaRange>\r
+   <x:Sel>2</x:Sel>\r
+   <x:NoThreeD2/>\r
+   <x:SelType>Single</x:SelType>\r
+   <x:LCT>Normal</x:LCT>\r
+   <x:DropStyle>Combo</x:DropStyle>\r
+   <x:DropLines>8</x:DropLines>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s100534" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:994.5pt;margin-top:102pt;width:121.5pt;height:15.75pt;z-index:5'\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <o:lock v:ext="edit" rotation="t" text="t"/>\r
+  <x:ClientData ObjectType="Drop">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    21, 4, 7, 11, 23, 28, 8, 14</x:Anchor>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:FmlaLink>Risikodaten!$AF$22</x:FmlaLink>\r
+   <x:Val>0</x:Val>\r
+   <x:Min>0</x:Min>\r
+   <x:Max>0</x:Max>\r
+   <x:Inc>1</x:Inc>\r
+   <x:Page>3</x:Page>\r
+   <x:Dx>16</x:Dx>\r
+   <x:FmlaRange>Risikodaten!$AG$19:$AG$21</x:FmlaRange>\r
+   <x:Sel>2</x:Sel>\r
+   <x:NoThreeD2/>\r
+   <x:SelType>Single</x:SelType>\r
+   <x:LCT>Normal</x:LCT>\r
+   <x:DropStyle>Combo</x:DropStyle>\r
+   <x:DropLines>8</x:DropLines>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s100535" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:971.25pt;margin-top:177pt;width:15pt;height:11.25pt;z-index:6;\r
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 14, 13, 3, 20, 34, 14, 0</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!$J$13</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s100536" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:971.25pt;margin-top:190.5pt;width:15pt;height:11.25pt;z-index:7;\r
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 14, 14, 3, 20, 34, 15, 0</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:FmlaLink>Risikodaten!$J$14</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s100537" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:971.25pt;margin-top:163.5pt;width:15pt;height:11.25pt;z-index:8;\r
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 14, 12, 3, 20, 34, 13, 0</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!$J$12</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s100539" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:971.25pt;margin-top:122.25pt;width:15pt;height:11.25pt;z-index:9;\r
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 14, 9, 2, 20, 34, 9, 17</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:FmlaLink>Risikodaten!$J$9</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s100760" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:1255.5pt;margin-top:336.75pt;width:15.75pt;height:11.25pt;\r
+  z-index:10;mso-wrap-style:tight' filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    25, 70, 24, 0, 26, 19, 24, 15</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:FmlaLink>Risikodaten!$AD$8</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="ComboBox1" o:spid="_x0000_s149031" type="#_x0000_t201"\r
+  style='position:absolute;margin-left:1190.25pt;margin-top:6.75pt;width:173.25pt;\r
+  height:28.5pt;z-index:11;mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]"\r
+  o:insetmode="auto">\r
+  <v:imagedata o:relid="rId1" o:title=""/>\r
+  <x:ClientData ObjectType="Pict">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    24, 55, 0, 9, 27, 70, 2, 13</x:Anchor>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:FmlaLink>Vermittler!$B$2</x:FmlaLink>\r
+   <x:FmlaRange>Vermittler!$M$6:$N$206</x:FmlaRange>\r
+   <x:CF>Pict</x:CF>\r
+   <x:AutoPict/>\r
+   <x:MapOCX/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149207" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:439.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:12;\r
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    9, 12, 25, 9, 9, 88, 25, 25</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_Allianz</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149208" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:354pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:13;\r
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    7, 12, 25, 9, 7, 88, 25, 25</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_Generali</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149209" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:269.25pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:14;\r
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    5, 13, 25, 9, 5, 89, 25, 25</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_Donau</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149210" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:524.25pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:15;\r
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    11, 11, 25, 9, 11, 87, 25, 25</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_AragSE</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149211" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:610.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:16;\r
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    13, 12, 25, 9, 13, 88, 25, 25</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_HDI</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149212" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:696pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:17;\r
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    15, 12, 25, 9, 15, 88, 25, 25</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_Zürich</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149213" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:781.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:18;\r
+  visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    17, 12, 25, 9, 17, 88, 25, 25</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_Uniqa</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s149258" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:182.25pt;margin-top:354.75pt;width:55.5pt;height:11.25pt;\r
+  z-index:19;visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:center'><font face="Calibri" size="200"\r
+   color="#800000"><b>Ausblenden<br>\r
+      </b></font><font face="Calibri" size="200" color="#800000"><b><br>\r
+      </b></font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Button">\r
+   <x:Anchor>\r
+    3, 11, 25, 4, 3, 85, 25, 19</x:Anchor>\r
+   <x:PrintObject>False</x:PrintObject>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:FmlaMacro>[0]!Ausblenden_VU_bisher</x:FmlaMacro>\r
+   <x:TextHAlign>Center</x:TextHAlign>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191175" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:993pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;z-index:20;\r
+  mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"\r
+  strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    21, 2, 19, 14, 22, 2, 20, 11</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!Y20</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191176" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:1042.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;\r
+  z-index:21;mso-wrap-style:tight' filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    22, 2, 19, 14, 22, 68, 20, 11</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!Z20</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191177" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:1096.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;\r
+  z-index:22;mso-wrap-style:tight' filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    23, 2, 19, 14, 23, 68, 20, 11</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!AA20</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191178" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:1150.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;\r
+  z-index:23;mso-wrap-style:tight' filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    24, 2, 19, 14, 24, 68, 20, 11</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!AB20</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191179" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:1204.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;\r
+  z-index:24;mso-wrap-style:tight' filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    25, 2, 19, 14, 25, 68, 20, 11</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!AC20</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191180" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:1258.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;\r
+  z-index:25;mso-wrap-style:tight' filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    26, 2, 19, 14, 26, 68, 20, 11</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!AD20</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191181" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:1312.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;\r
+  z-index:26;mso-wrap-style:tight' filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    27, 2, 19, 14, 27, 68, 20, 11</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!AE20</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191430" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:970.5pt;margin-top:13.5pt;width:15pt;height:10.5pt;z-index:27;\r
+  mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill o:detectmouseclick="t"/>\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 13, 1, 1, 20, 33, 1, 15</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!$I$8</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191431" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:970.5pt;margin-top:26.25pt;width:15pt;height:11.25pt;z-index:28;\r
+  mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill o:detectmouseclick="t"/>\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 13, 2, 1, 20, 33, 2, 16</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:Checked>1</x:Checked>\r
+   <x:FmlaLink>Risikodaten!$I22</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="_x0000_s191432" type="#_x0000_t201" style='position:absolute;\r
+  margin-left:970.5pt;margin-top:39pt;width:15pt;height:11.25pt;z-index:29;\r
+  mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"\r
+  stroked="f" strokecolor="windowText [64]" o:insetmode="auto">\r
+  <v:fill o:detectmouseclick="t"/>\r
+  <v:path shadowok="t" strokeok="t" fillok="t"/>\r
+  <o:lock v:ext="edit" rotation="t"/>\r
+  <v:textbox style='mso-direction-alt:auto' o:singleclick="f">\r
+   <div style='text-align:left'></div>\r
+  </v:textbox>\r
+  <x:ClientData ObjectType="Checkbox">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    20, 13, 3, 1, 20, 33, 3, 16</x:Anchor>\r
+   <x:AutoFill>False</x:AutoFill>\r
+   <x:AutoLine>False</x:AutoLine>\r
+   <x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>\r
+   <x:TextVAlign>Center</x:TextVAlign>\r
+   <x:FmlaLink>Risikodaten!$I$29</x:FmlaLink>\r
+   <x:NoThreeD/>\r
+  </x:ClientData>\r
+ </v:shape><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75"\r
+  o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">\r
+  <v:stroke joinstyle="miter"/>\r
+  <v:formulas>\r
+   <v:f eqn="if lineDrawn pixelLineWidth 0"/>\r
+   <v:f eqn="sum @0 1 0"/>\r
+   <v:f eqn="sum 0 0 @1"/>\r
+   <v:f eqn="prod @2 1 2"/>\r
+   <v:f eqn="prod @3 21600 pixelWidth"/>\r
+   <v:f eqn="prod @3 21600 pixelHeight"/>\r
+   <v:f eqn="sum @0 0 1"/>\r
+   <v:f eqn="prod @6 1 2"/>\r
+   <v:f eqn="prod @7 21600 pixelWidth"/>\r
+   <v:f eqn="sum @8 21600 0"/>\r
+   <v:f eqn="prod @7 21600 pixelHeight"/>\r
+   <v:f eqn="sum @10 21600 0"/>\r
+  </v:formulas>\r
+  <v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>\r
+  <o:lock v:ext="edit" aspectratio="t"/>\r
+ </v:shapetype><v:shape id="Grafik_x0020_5" o:spid="_x0000_s232729" type="#_x0000_t75"\r
+  style='position:absolute;margin-left:14.25pt;margin-top:73.5pt;width:604.5pt;\r
+  height:102.75pt;z-index:30;visibility:visible;mso-wrap-style:square'\r
+  filled="t" fillcolor="white [9]" stroked="t" strokecolor="windowText [64]">\r
+  <v:imagedata o:relid="rId2" o:title=""/>\r
+  <x:ClientData ObjectType="Pict">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    1, 1, 5, 9, 13, 23, 13, 2</x:Anchor>\r
+   <x:FmlaPict>Antrag!$B$7:$K$13</x:FmlaPict>\r
+   <x:CF>Pict</x:CF>\r
+   <x:Camera/>\r
+  </x:ClientData>\r
+ </v:shape><v:shape id="Grafik_x0020_24" o:spid="_x0000_s232730" type="#_x0000_t75"\r
+  style='position:absolute;margin-left:15pt;margin-top:.75pt;width:603.75pt;\r
+  height:45pt;z-index:31;visibility:visible;mso-wrap-style:square'\r
+  o:preferrelative="f" filled="t" fillcolor="white [9]" stroked="t"\r
+  strokecolor="windowText [64]">\r
+  <v:imagedata o:relid="rId3" o:title=""/>\r
+  <o:lock v:ext="edit" aspectratio="f"/>\r
+  <x:ClientData ObjectType="Pict">\r
+   <x:SizeWithCells/>\r
+   <x:Anchor>\r
+    1, 2, 0, 1, 13, 23, 3, 10</x:Anchor>\r
+   <x:FmlaPict>$DO$1:$DZ$3</x:FmlaPict>\r
+   <x:CF>Pict</x:CF>\r
+   <x:Camera/>\r
+  </x:ClientData>\r
+ </v:shape></xml>
\ No newline at end of file