From f8e27ee19b961f5927d4fec4730d93d1466168e1 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Mon, 11 Apr 2022 13:51:31 +0000 Subject: [PATCH] Prevent an overly large allocation when using HPSF Add a sample document from fuzzing which contains invalid/oversized values git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1899749 13f79535-47bb-0310-9956-ffa450edef68 --- .../main/java/org/apache/poi/hpsf/Array.java | 14 +++++++++----- .../apache/poi/hssf/dev/TestBiffViewer.java | 2 ++ test-data/spreadsheet/poi-fuzz.xls | Bin 0 -> 7680 bytes test-data/spreadsheet/stress.xls | Bin 38912 -> 39424 bytes 4 files changed, 11 insertions(+), 5 deletions(-) create mode 100644 test-data/spreadsheet/poi-fuzz.xls diff --git a/poi/src/main/java/org/apache/poi/hpsf/Array.java b/poi/src/main/java/org/apache/poi/hpsf/Array.java index 94af1369f8..eeaf58683f 100644 --- a/poi/src/main/java/org/apache/poi/hpsf/Array.java +++ b/poi/src/main/java/org/apache/poi/hpsf/Array.java @@ -16,12 +16,15 @@ ==================================================================== */ package org.apache.poi.hpsf; +import org.apache.poi.util.IOUtils; import org.apache.poi.util.Internal; import org.apache.poi.util.LittleEndianByteArrayInputStream; @Internal -public class Array -{ +public class Array { + + private static final int MAX_NUMBER_OF_ARRAY_SCALARS = 100_000; + static class ArrayDimension { private long _size; @SuppressWarnings("unused") @@ -33,8 +36,7 @@ public class Array } } - static class ArrayHeader - { + static class ArrayHeader { private ArrayDimension[] _dimensions; private int _type; @@ -47,7 +49,7 @@ public class Array String msg = "Array dimension number "+numDimensionsUnsigned+" is not in [1; 31] range"; throw new IllegalPropertySetDataException(msg); } - + int numDimensions = (int) numDimensionsUnsigned; _dimensions = new ArrayDimension[numDimensions]; @@ -86,6 +88,8 @@ public class Array } int numberOfScalars = (int) numberOfScalarsLong; + IOUtils.safelyAllocateCheck(numberOfScalars, MAX_NUMBER_OF_ARRAY_SCALARS); + _values = new TypedPropertyValue[numberOfScalars]; int paddedType = (_header._type == Variant.VT_VARIANT) ? 0 : _header._type; for ( int i = 0; i < numberOfScalars; i++ ) { diff --git a/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java b/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java index 1059213502..5013e45258 100644 --- a/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java +++ b/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java @@ -40,6 +40,8 @@ class TestBiffViewer extends BaseTestIteratingXLS { excludes.put("XRefCalc.xls", RuntimeException.class); excludes.put("61300.xls", IndexOutOfBoundsException.class); + excludes.put("poi-fuzz.xls", RecordFormatException.class); + return excludes; } diff --git a/test-data/spreadsheet/poi-fuzz.xls b/test-data/spreadsheet/poi-fuzz.xls new file mode 100644 index 0000000000000000000000000000000000000000..9acb7005e07f64a8c685e8130849bd8f27318ff4 GIT binary patch literal 7680 zcmeHMZHSar6h1S~?9S$@v%6|)Ilb%}xgTS@N@S_KW35Xa%FOsl z)L2Ro28DtpMhQhkP*zy|=!Zigiy%cPp$KaDCkV1AP+50+p7XvlzB@XiS&}w)Irrnd zXP$fRx#ynyvEP4Jb9&#WQ_e_HYL`(moU4)w2j7LdFW>fy+=V)M!?|3J>?#nd<#Zca zpvs4dtnkY4y+=tI?j84B$?`qBofB0NRO!w5f^nh2%YA+ zD&T8wc;#N?V`Z{xSF3rQ=AWqS*P73hTG=FX<;gi)r_BZe{d9#pq;jumUa$FBVUu*fgn>`)siptwmS`M!?gENu73uoDh)6itWH@vR2ccsz zhcflSdTR`j2nR#qV8GKZjnX;-A>0}69*JOc3J8U^B6LZM%y%FZ)N_J3nKn*GN3kwl z(tIUSu{w%W&_KsTqyh&zotE+HBY)-$Ev@XJK|b9_`G4d;U7Jr&znXk0K2fhGe<$-@ zVsLnN%G5We@{e{~ z{!D#{`USTCbD%LAC##XKmT_9I(P-%h=Fo?~{m>m<+!0oOlk%H2e@QtR$mG-guoq&h zY{i$XhkZ=|y{yvPG~XxnD&a!^E{vJ!)v0rbF1>K7BVURvgDl429;@G}sim*ajonP^ zdLRLFoLth;3iM|B5iyiKh_t(Fb$lWrZClw?$c?h97OcpxdI)+L%+hAFy3OPKj0yd3 zn=G%XZ3b38L z)}l-rIe>=T<;mdbkR$6rLpz7SUERh`I5*b z=!VYu=ltg9pZ7Mt>GImcIp_Ry?ef;e+Z2~j4T!%fr`yv4oL8peGJwftOyK4Jgo`XybQQqo@zD>;a;PmMpa9JLoREJ5|km&?+3UB2J^s!liYx(vTHc;HahWknqepL4qE$NfBrw%i7q2-*Rnjdy`) r^KU>-n{w}7+C3@x!P}wt&n-JSG`VrZo}Ps#cFjG!_3SHq4$t`u+##=; literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index d8237a26ff2dac5ff5d76c4f4dc4d7bdf5c65bcf..ecfae46d48327d4a9ae75c48bfde0706c51a7cf9 100644 GIT binary patch delta 6214 zcmZXYd3+S*8ONX5oP>l;3_95?Llz-{Bpb4koDgCtsGLT^l?yQ>n@xaZm+V4rb^~5u zr05GhtVfT}r>$tMy0*2}delFxXwlXlR%+GO*0c7at;H&R-e;c~@{Y+Tlf1wA{l3rh z&dfWrnb?Dl*dvZ(zO1#tU)cbwA6kCKaq(3se0u);dGlwT9N)I_<%g5Eri!~W^2FAR z_3_6t7HfIMH8Pt4R}6RgLy^AVK==m8hEoH#XHKP*CjqR8-3xSSEd}!62*Wqwyb}#=M#TlUuxqoz*-V@%&TO_C+Kdh9u*S+r za;LbhOV@4{_jbA4k8)y*mDoZFFDJI(4D#UfmdosAD=IEH#;&c{iwn#-ZKYn0ih^!k z^NO18LhW|3z1zLeJQ3ThTHC0W!IW)OONe{Amt1~=E4EnP7V>_9y)ESZqUAFCYDL8b zUlKWfw{}95`SqxoXjKxe)=_Pv#Fv@drp%;`W@7fzX7$ph^wOq~+bnXsBuC*6Mz<^I zb_LyTq1zR7yMk`F&>htDSD4(PkUJD|O^1c3;%usSLk+3 z&V>TJ4pV7qTuYw2#ipKx%cko)NWX_t8L$J}a^sS7P-X}Ap@T`>A&K!Pd-@#W#)etx zQH-R)c@QOiOOuc&0(~{~`)hr>|(i7`jVoXP0uEcG;4hQurtA9;ECu)<|a4#oPUbD-T=R^e54vb;*U5 zWSCkuAB|yJpH-r1KzCO&CrtMm`PoNax?#x?lLM|5<`W~5$ngFM9!zs}ea=UW5@`zP=gepHT z4uuL={)}slDo1-%IdY>`a+H$h@gJq?HRAnHq4nWtOi7Me$uT84mPm4EV^-he)c1?r z)3`GKaU!qd%(z7!m*glsZ-wN=^^#>XPtgP_I+*AQLYo)Lgo2*1&=b^j5tApV>7O%s z!fN^eDp4JN!L|d0HkaA~M9ZZnp9_hlb^wDec$wYu5v9W~t&v5goOiOGiC=p^cCkb@tT0U9+YE$A5jeW7SfIm|ICT7?c- zG-efzDMe$ls8usYQjgF8G+G0=!V z=9d9ZNNU0w*ab8}Q~b`sc1_C{AB79F=i+&hZ#bO4!F{r#bm;JkIJLi6`>i;;zf^lw zc!o-~Gh#h%e zEoRJA7&8^dOobtDK05qKct&I&^&{@OKQkjsVPq+cEQKNe`O)ERaf}%EBjX)rI2DFd zVc?0QQ=T}c*~EDF_EFi!oKbh(dyL3Y5IG7WM?qXfi1$T^7*ojjfEl?8BUfSMDva60 z_=|XBv_|_-n|+JD9IXsLEiJcZkj#RpM$-3fwb zz@=iG@=42hGlCGMki7Uz6cPFC{SDpino7JDlcZ-w-VQwMXLPTqf6V!wFrpb^MsZHbauV<C zOFG@`W!II8x6tR?2f?5$P2wKi`Z zc`spa9oL$Bz2VeZTguwn>y1DjYs(boG8?m=m@f9#E8cpWcR6|U*}I%;oyPiZ)*4tl zhuR$0E>CFjq8sjVEHhYaR0=iP3ay|*bJ@Fsp`YGlI15<&9BU;v8vze%D;4HS8*>#g z=dpK{;$3C)UP0bV*?R@odf;ZmIiIyFS$h@hFJSE|g?W{Yxtf@T>|L#RSKGX6$XmqT zHC*f3!-jJqYin6Ma@YtgVr`wmTxVmhCuT8w*DK!jHtz=VmaumN*P3<2aF()mHETcMEwhWA7HOKX8lTT*8`s(I)>%yWw%EL_i&^tATyvD&08d0%YAA9%I-6NlI+az%^COm{UuI(2fx cE1H;>JX^%XS#6Ejcl?m!%_H%1$5WI3535zqV*mgE delta 5792 zcmZ9Q3s@A_702%^?5fMcfJnw=8BqfwEJg$s6(upoVAT2o<*_JHz*SLTg&-gcM3ER@ zD7V^|)#OY2C2bmwZu&~2ZEC+Ssco%&BqnOp+BSWrNm}j0v}(^ib7pq$B%hPq|NZ}e z=iEE5b^2d%^uO#lT#)z}qkobaD?2mqnj_`zy?gh}KZ{}V?va&O&c?5C@n-i@UgI9a zPmLN8Ip_8(V}mnA*3A}n);G4cZ*FOB+ryIC`K`mA1J3brjFm=?cn0-InZHqqoXIax zoO9WL$|5(WsIxk<-QVoufyylkC$j#ymj2n#0%wO2j>{ zMwxJPe3~f6!Z4%2zc*8&V+V7vOunad>a;Qxr!{FzY>lBh*;uw7MvB7)9vAbWz6umCdx~7EpeZjiNvn{w zmolqZ980H6JXFZHGJ^axKUuH!?IW#R;*?9Aa*I>WVmakZaQ0KRa;w7%P`vB_kt-x} z1(HWmrh?CCP;+$4DR>9XIg7U%6fZl(n;LvMLo~bE>S;ChbeI^cv8N;ar3OtOCT)$> z!5Zvfh~H??l*9aXL$<awU=1Hx>oVE~+eVmE^55ywq!zwUTO3yzD6T zRW0>ZO?`dTsP&nvsg^j^7N-U|$KZG#uAds<_~1-C@LbnGPa69S&Us)ip6P5H%)4+l zfXUBNG9V=bW^xT+JuG00)?)N?6s?t_wPqBPwYKD1On#o11bvxbz`Td8wRzT|=Qw{N zn6ogp;X2e$z){==by!v09(A}~iJ%)JvFMX95}nrxcH~NMv%`_1@HJcJ#HF)woNp%sODu~!&x`fjy>g#*zHS{Y_ugeV)7Iv zH%iHkn0$_s8(I7q>1qjL^faHc)mLq9M$m@egr1iPze&PxLj1FY-(*W}#^f3P>{egq zS@LYQdA6V@!mmLGCTEMy(}bQ^kl8ZN9#5l4q;Uvki2O zeG87_gl+@6#=ec-Bp5m1zDvhFbJDyEPSdO8ZpQ3)tWj*XSOV(7XoMkI`%kK0dx{xy)BcD<~Q>$*s7gzUdTdmC&sg zx)ssl-7EH?7170nZnZAu5Td_Ft`MTlrb7}rWRXLHJk#nrBy}CK(AyFHI-$2C+QZK^ zXZK}Unz+9fz)0-Mc1Rk#(uT?JldH{0S|f4yUZ6~y)l?fU*Ce-LPbRs|BDV|jIQ9dA zwM*!BT<-K za_zt_%=5X!*mZueRoiTyy&cFg&)yDeIi1M4NSscI(AL7N$UHHm=|3V) zm$WNg$XUYYhcx94ULDF_VEVezXI?Gch7TCxWOiHiy0P9QVs~S`pYYd1*-Om3awjCk zT?r3;m=#y+PFSIr{gg62@L!ExwnpN{G9TtWm{s}m?P-1E+0QJGlTBbhhmq)|2Wf&E zmPlb~ona)Iw`kbvKMegx$zkX)N)B7(Uib|PZT$iYh*x|spv8iWS9~wPG-f`vdjTlk zZ@KMt{N&-Z1ScS&Q8+pyFSG}g37O;4KrnyA#FU=fQFS&hBL z-|oy+-X8AqD_3|v9N*zpaD0~!bote*WObtTd49f2SFZ8vUB21ZVMa9U!u6&@YXUg} zRE_DFaFGve&yf%$4~la|A*KUr4>xX6%4_g zxFRP?E59G>+~x(le99+$=`P=*{}LlhVq_uXf5ga=7}?0UL%D3s-DUjru8ib+Bu+BL zYr8VUPb0kIb4WCHE6272laZ>Bce3Q2Z1d)#*FoM~vsm5kjN~{H^GtF7?u=kOiGCEF zFcRm>Z=;I8Cu+<^-h9cMZ}Uz;?+EfvLGJ~gG@vUZdH#UEY!uB*wJ74Ap9&O>?S-s3 zGgGBqEkL51as@_?pBT{91k$FFc5y%tdPpm@_+mwcwl0g1nMmFu$y;Reiub0*lE^!q zYAxHNt14+TNbBCC2a`#gDKTf-nBq;Vu@v$aOWtCecNTg_lXn)?x(oGFNt;bt-k=^F zL)sjPImgB^jIWnh^SA5ipdc{YrSZ@V- zA0V&zOa)%P?4YhrC2cin-3Rqx0cql6Qj{q^CdD!(|(r0c6e~ulT$Z^#*L-TJ+8&ulSxLYMnZytHq?PCGF}V zy<`??>m=qn8?z3Xv&k#I)(B?d&^C1rX^)$AhIF-rwDo44A-!ZSY2tfKwD%3RI`vp* z9(l$081P044_{JvLA>Ye@T|B*@yvY){`7Bjb~yOTqp7^=sAuFVcixrTN$)6pLi`xs WfAp5Jh(B>`x8tq7kx!1f;{Fd{dVdW7 -- 2.39.5