#59893 - Forbid calls to InputStream.available

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1830400 13f79535-47bb-0310-9956-ffa450edef68

2 files changed, 7 insertions, 9 deletions

diff --git a/src/java/org/apache/poi/hssf/record/ObjRecord.java b/src/java/org/apache/poi/hssf/record/ObjRecord.java
index e41e6cbc27..d1b4ab4d11 100644
--- a/src/java/org/apache/poi/hssf/record/ObjRecord.java
+++ b/src/java/org/apache/poi/hssf/record/ObjRecord.java
@@ -17,14 +17,13 @@
         
 package org.apache.poi.hssf.record;
 
-import java.io.ByteArrayInputStream;
 import java.util.ArrayList;
 import java.util.List;
 
 import org.apache.poi.util.HexDump;
 import org.apache.poi.util.LittleEndian;
+import org.apache.poi.util.LittleEndianByteArrayInputStream;
 import org.apache.poi.util.LittleEndianByteArrayOutputStream;
-import org.apache.poi.util.LittleEndianInputStream;
 import org.apache.poi.util.RecordFormatException;
 
 /**
@@ -85,8 +84,7 @@ public final class ObjRecord extends Record implements Cloneable {
         */
 
 		subrecords = new ArrayList<>();
-		ByteArrayInputStream bais = new ByteArrayInputStream(subRecordData);
-		LittleEndianInputStream subRecStream = new LittleEndianInputStream(bais);
+		LittleEndianByteArrayInputStream subRecStream = new LittleEndianByteArrayInputStream(subRecordData);
 		CommonObjectDataSubRecord cmo = (CommonObjectDataSubRecord)SubRecord.createSubRecord(subRecStream, 0);
         subrecords.add(cmo);
         while (true) {
@@ -96,7 +94,7 @@ public final class ObjRecord extends Record implements Cloneable {
 				break;
 			}
 		}
-		int nRemainingBytes = bais.available();
+		final int nRemainingBytes = subRecordData.length-subRecStream.getReadIndex();
 		if (nRemainingBytes > 0) {
 			// At present (Oct-2008), most unit test samples have (subRecordData.length % 2 == 0)
 			_isPaddedToQuadByteMultiple = subRecordData.length % MAX_PAD_ALIGNMENT == 0;
diff --git a/src/java/org/apache/poi/hssf/record/crypto/Biff8DecryptingStream.java b/src/java/org/apache/poi/hssf/record/crypto/Biff8DecryptingStream.java
index 3c5be4267c..99c5d46dc9 100644
--- a/src/java/org/apache/poi/hssf/record/crypto/Biff8DecryptingStream.java
+++ b/src/java/org/apache/poi/hssf/record/crypto/Biff8DecryptingStream.java
@@ -32,6 +32,7 @@ import org.apache.poi.util.LittleEndian;
 import org.apache.poi.util.LittleEndianConsts;
 import org.apache.poi.util.LittleEndianInput;
 import org.apache.poi.util.RecordFormatException;
+import org.apache.poi.util.SuppressForbidden;
 
 public final class Biff8DecryptingStream implements BiffHeaderInput, LittleEndianInput {
 
@@ -39,7 +40,6 @@ public final class Biff8DecryptingStream implements BiffHeaderInput, LittleEndia
     //arbitrarily selected; may need to increase
     private static final int MAX_RECORD_LENGTH = 100_000;
 
-    private final EncryptionInfo info;
     private ChunkedCipherInputStream ccis;
     private final byte buffer[] = new byte[LittleEndianConsts.LONG_SIZE];
     private boolean shouldSkipEncryptionOnCurrentRecord;
@@ -54,9 +54,8 @@ public final class Biff8DecryptingStream implements BiffHeaderInput, LittleEndia
     	        stream = new PushbackInputStream(in, initialOffset);
     	        ((PushbackInputStream)stream).unread(initialBuf);
     	    }
-    	    
-            this.info = info;
-            Decryptor dec = this.info.getDecryptor();
+
+            Decryptor dec = info.getDecryptor();
             dec.setChunkSize(RC4_REKEYING_INTERVAL);
             ccis = (ChunkedCipherInputStream)dec.getDataStream(stream, Integer.MAX_VALUE, 0);
             
@@ -69,6 +68,7 @@ public final class Biff8DecryptingStream implements BiffHeaderInput, LittleEndia
 	}
 
 	@Override
+    @SuppressForbidden("just delegating")
     public int available() {
 		return ccis.available();
 	}