add extra max size config

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1898238 13f79535-47bb-0310-9956-ffa450edef68

11 files changed, 48 insertions, 9 deletions

diff --git a/poi-ooxml-lite-agent/src/main/java9/module-info.class b/poi-ooxml-lite-agent/src/main/java9/module-info.class
index 9ef3959781..25db90320c 100644
--- a/poi-ooxml-lite-agent/src/main/java9/module-info.class
+++ b/poi-ooxml-lite-agent/src/main/java9/module-info.class
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XMLSlideShow.java b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XMLSlideShow.java
index 72418a546f..f3867247dd 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XMLSlideShow.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XMLSlideShow.java
@@ -556,7 +556,7 @@ public class XMLSlideShow extends POIXMLDocument
      */
     @Override
     public XSLFPictureData addPicture(InputStream is, PictureType format) throws IOException {
-        return addPicture(IOUtils.toByteArray(is, XSLFPictureData.getMaxImageSize()), format);
+        return addPicture(IOUtils.toByteArrayWithMaxLength(is, XSLFPictureData.getMaxImageSize()), format);
     }
 
 
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureData.java b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureData.java
index e9cefc20bc..231419127a 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureData.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureData.java
@@ -104,7 +104,7 @@ public final class XSLFPictureData extends POIXMLDocumentPart implements Picture
      */
     public byte[] getData() {
         try (InputStream stream = getInputStream()) {
-            return IOUtils.toByteArray(stream, getMaxImageSize());
+            return IOUtils.toByteArrayWithMaxLength(stream, getMaxImageSize());
         } catch (IOException e) {
             throw new POIXMLException(e);
         }
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFPictureData.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFPictureData.java
index 4dc8ca78a7..9a2c1d02e1 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFPictureData.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFPictureData.java
@@ -105,7 +105,7 @@ public class XSSFPictureData extends POIXMLDocumentPart implements PictureData {
      */
     public byte[] getData() {
         try (InputStream inputStream = getPackagePart().getInputStream()) {
-            return IOUtils.toByteArray(inputStream, getMaxImageSize());
+            return IOUtils.toByteArrayWithMaxLength(inputStream, getMaxImageSize());
         } catch(IOException e) {
             throw new POIXMLException(e);
         }
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFChart.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFChart.java
index 1c51924507..718e036807 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFChart.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFChart.java
@@ -94,7 +94,7 @@ public class XWPFChart extends XDDFChart {
         if (this.checksum == null) {
             byte[] data;
             try (InputStream is = getPackagePart().getInputStream()) {
-                data = IOUtils.toByteArray(is, XWPFPictureData.getMaxImageSize());
+                data = IOUtils.toByteArrayWithMaxLength(is, XWPFPictureData.getMaxImageSize());
             } catch (IOException e) {
                 throw new POIXMLException(e);
             }
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFComments.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFComments.java
index 52253b6a97..7459f83a82 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFComments.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFComments.java
@@ -107,7 +107,7 @@ public class XWPFComments extends POIXMLDocumentPart {
      * @throws IOException            If reading the picture-data from the stream fails.
      */
     public String addPictureData(InputStream is, int format) throws InvalidFormatException, IOException {
-        byte[] data = IOUtils.toByteArray(is, XWPFPictureData.getMaxImageSize());
+        byte[] data = IOUtils.toByteArrayWithMaxLength(is, XWPFPictureData.getMaxImageSize());
         return addPictureData(data, format);
     }
 
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFDocument.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFDocument.java
index 62192da980..1f3c1b899c 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFDocument.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFDocument.java
@@ -1520,7 +1520,7 @@ public class XWPFDocument extends POIXMLDocument implements Document, IBody {
 
     public String addPictureData(InputStream is, int format) throws InvalidFormatException {
         try {
-            byte[] data = IOUtils.toByteArray(is, XWPFPictureData.getMaxImageSize());
+            byte[] data = IOUtils.toByteArrayWithMaxLength(is, XWPFPictureData.getMaxImageSize());
             return addPictureData(data, format);
         } catch (IOException e) {
             throw new POIXMLException(e);
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFHeaderFooter.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFHeaderFooter.java
index 4d423e1cbf..0bbdf47766 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFHeaderFooter.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFHeaderFooter.java
@@ -279,7 +279,7 @@ public abstract class XWPFHeaderFooter extends POIXMLDocumentPart implements IBo
      * @throws IOException If reading the picture-data from the stream fails.
      */
     public String addPictureData(InputStream is, int format) throws InvalidFormatException, IOException {
-        byte[] data = IOUtils.toByteArray(is, XWPFPictureData.getMaxImageSize());
+        byte[] data = IOUtils.toByteArrayWithMaxLength(is, XWPFPictureData.getMaxImageSize());
         return addPictureData(data, format);
     }
 
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFPictureData.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFPictureData.java
index 20cebfc175..a4a84021ed 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFPictureData.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFPictureData.java
@@ -111,7 +111,7 @@ public class XWPFPictureData extends POIXMLDocumentPart {
      */
     public byte[] getData() {
         try (InputStream stream = getPackagePart().getInputStream()) {
-            return IOUtils.toByteArray(stream, getMaxImageSize());
+            return IOUtils.toByteArrayWithMaxLength(stream, getMaxImageSize());
         } catch (IOException e) {
             throw new POIXMLException(e);
         }
@@ -165,7 +165,7 @@ public class XWPFPictureData extends POIXMLDocumentPart {
         if (this.checksum == null) {
             byte[] data;
             try (InputStream is = getPackagePart().getInputStream()) {
-                data = IOUtils.toByteArray(is, getMaxImageSize());
+                data = IOUtils.toByteArrayWithMaxLength(is, getMaxImageSize());
             } catch (IOException e) {
                 throw new POIXMLException(e);
             }
diff --git a/poi/src/main/java/org/apache/poi/util/IOUtils.java b/poi/src/main/java/org/apache/poi/util/IOUtils.java
index f220d34665..b538276e3b 100644
--- a/poi/src/main/java/org/apache/poi/util/IOUtils.java
+++ b/poi/src/main/java/org/apache/poi/util/IOUtils.java
@@ -202,6 +202,45 @@ public final class IOUtils {
         }
     }
 
+    /**
+     * Reads the input stream, and returns the bytes read.
+     *
+     * @param stream The byte stream of data to read.
+     * @param maxLength if the input is equal to/longer than {@code maxLength} bytes,
+     *                  then throw an {@link IOException} complaining about the length.
+     *                  use {@link Integer#MAX_VALUE} to disable the check - if {@link #setByteArrayMaxOverride(int)} is
+     *                  set then that max of that value and this maxLength is used
+     * @return A byte array with the read bytes.
+     * @throws IOException If reading data fails or EOF is encountered too early for the given length.
+     * @since POI 5.2.1
+     */
+    public static byte[] toByteArrayWithMaxLength(InputStream stream, final int maxLength) throws IOException {
+        if (maxLength < 0L) {
+            throw new RecordFormatException("Can't allocate an array of length < 0");
+        }
+        final int derivedMaxLength = BYTE_ARRAY_MAX_OVERRIDE <= 0 ? maxLength : Math.max(maxLength, BYTE_ARRAY_MAX_OVERRIDE);
+
+        try (UnsynchronizedByteArrayOutputStream baos = new UnsynchronizedByteArrayOutputStream(derivedMaxLength == Integer.MAX_VALUE ? 4096 : derivedMaxLength)) {
+            byte[] buffer = new byte[4096];
+            int totalBytes = 0, readBytes;
+            do {
+                readBytes = stream.read(buffer, 0, Math.min(buffer.length, derivedMaxLength - totalBytes));
+                totalBytes += Math.max(readBytes, 0);
+                if (readBytes > 0) {
+                    baos.write(buffer, 0, readBytes);
+                }
+
+                checkByteSizeLimit(totalBytes);
+            } while (totalBytes < derivedMaxLength && readBytes > -1);
+
+            if (derivedMaxLength != Integer.MAX_VALUE && totalBytes == derivedMaxLength) {
+                throw new IOException("MaxLength (" + derivedMaxLength + ") reached - stream seems to be invalid.");
+            }
+
+            return baos.toByteArray();
+        }
+    }
+
     private static void checkLength(long length, int maxLength) {
         if (BYTE_ARRAY_MAX_OVERRIDE > 0) {
             if (length > BYTE_ARRAY_MAX_OVERRIDE) {
diff --git a/poi/src/test/java9/module-info.class b/poi/src/test/java9/module-info.class
index 5f441458ec..1b7e89aff8 100644
--- a/poi/src/test/java9/module-info.class
+++ b/poi/src/test/java9/module-info.class