==================================================================== */
package org.apache.poi.hpsf;
+import java.util.ArrayList;
+import java.util.List;
+
import org.apache.poi.util.Internal;
import org.apache.poi.util.LittleEndianByteArrayInputStream;
}
final int length = (int) longLength;
- _values = new TypedPropertyValue[length];
-
+ //BUG-61295 -- avoid OOM on corrupt file. Build list instead
+ //of allocating array of length "length".
+ //If the length is corrupted and crazily big but < Integer.MAX_VALUE,
+ //this will trigger a RuntimeException "Buffer overrun" in lei.checkPosition
+ List<TypedPropertyValue> values = new ArrayList<TypedPropertyValue>();
int paddedType = (_type == Variant.VT_VARIANT) ? 0 : _type;
for ( int i = 0; i < length; i++ ) {
TypedPropertyValue value = new TypedPropertyValue(paddedType, null);
} else {
value.readValue(lei);
}
- _values[i] = value;
+ values.add(value);
}
+ _values = values.toArray(new TypedPropertyValue[values.size()]);
}
TypedPropertyValue[] getValues(){