From: Nick Burch <nick@apache.org>
Date: Wed, 29 May 2013 17:31:50 +0000 (+0000)
Subject: More on bug #54682 - check for the end offset overflowing too
X-Git-Tag: 3.10-beta1~43
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=1a2591a8c1ca077a9885dc078a56bb677ff0c670;p=poi.git

More on bug #54682 - check for the end offset overflowing too

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1487558 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java b/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java
index 6cf53f7460..967f46e803 100644
--- a/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java
+++ b/src/scratchpad/src/org/apache/poi/hwpf/model/UnhandledDataStructure.java
@@ -34,10 +34,12 @@ public final class UnhandledDataStructure
   public UnhandledDataStructure(byte[] buf, int offset, int length)
   {
     // Sanity check the size they've asked for
-    if (offset + length > buf.length)
+    int offsetEnd = offset + length;
+    if (offsetEnd > buf.length || offsetEnd < 0)
     {
       throw new IndexOutOfBoundsException("Buffer Length is " + buf.length + " " +
-                                          "but code is tried to read " + length + " from offset " + offset);
+                                          "but code is tried to read " + length + " " + 
+                                          "from offset " + offset + " to " + offsetEnd);
     }
     if (offset < 0 || length < 0)
     {
@@ -46,7 +48,7 @@ public final class UnhandledDataStructure
     }
     
     // Save that requested portion of the data 
-    _buf = Arrays.copyOfRange(buf, offset, offset + length);
+    _buf = Arrays.copyOfRange(buf, offset, offsetEnd);
   }
 
   byte[] getBuf()