From 1d0badc7c859e64ed7eb0a84cf82e537217ffb74 Mon Sep 17 00:00:00 2001 From: Tim Allison Date: Fri, 14 Oct 2016 14:57:29 +0000 Subject: [PATCH] add length sanity check for length of embedded OLE10Native (BUG 60256) git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1764927 13f79535-47bb-0310-9956-ffa450edef68 --- .../org/apache/poi/poifs/filesystem/Ole10Native.java | 5 ++++- .../apache/poi/poifs/filesystem/TestOle10Native.java | 10 ++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java b/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java index aee6747592..d11841dd59 100644 --- a/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java +++ b/src/java/org/apache/poi/poifs/filesystem/Ole10Native.java @@ -192,7 +192,10 @@ public class Ole10Native { dataSize = totalSize; break; } - + + if ((long)dataSize + (long)ofs > (long)data.length) { //cast to avoid overflow + throw new Ole10NativeException("Invalid Ole10Native: declared data length > available data"); + } dataBuffer = new byte[dataSize]; System.arraycopy(data, ofs, dataBuffer, 0, dataSize); ofs += dataSize; diff --git a/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java b/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java index a8826ffad0..0abdf8489c 100644 --- a/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java +++ b/src/testcases/org/apache/poi/poifs/filesystem/TestOle10Native.java @@ -20,6 +20,8 @@ package org.apache.poi.poifs.filesystem; import static org.hamcrest.core.IsEqual.equalTo; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertThat; +import static org.junit.Assert.assertTrue; +import static org.junit.Assert.fail; import java.io.ByteArrayOutputStream; import java.io.File; @@ -110,10 +112,14 @@ public class TestOle10Native { } @Test - @Ignore("BUG 60256") public void testOleNativeOOM() throws IOException, Ole10NativeException { POIFSFileSystem fs = new POIFSFileSystem(dataSamples.openResourceAsStream("60256.bin")); - Ole10Native ole = Ole10Native.createFromEmbeddedOleObject(fs); + try { + Ole10Native.createFromEmbeddedOleObject(fs); + fail("Should have thrown exception because OLENative lacks a length parameter"); + } catch (Ole10NativeException e) { + assertTrue(e.getMessage().indexOf("declared data length") > -1); + } } } -- 2.39.5