[Bug-61268] avoid NegativeArraySizeException parsing doc file

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1801395 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 5 insertions, 2 deletions

diff --git a/src/java/org/apache/poi/ddf/UnknownEscherRecord.java b/src/java/org/apache/poi/ddf/UnknownEscherRecord.java
index d49176d2bd..55689e2a42 100644
--- a/src/java/org/apache/poi/ddf/UnknownEscherRecord.java
+++ b/src/java/org/apache/poi/ddf/UnknownEscherRecord.java
@@ -55,8 +55,7 @@ public final class UnknownEscherRecord extends EscherRecord implements Cloneable
             thedata = new byte[0];
             offset += 8;
             bytesWritten += 8;
-            while ( bytesRemaining > 0 )
-            {
+            while ( bytesRemaining > 0 ) {
                 EscherRecord child = recordFactory.createRecord( data, offset );
                 int childBytesWritten = child.fillFields( data, offset, recordFactory );
                 bytesWritten += childBytesWritten;
@@ -67,6 +66,10 @@ public final class UnknownEscherRecord extends EscherRecord implements Cloneable
             return bytesWritten;
         }
 
+        if (bytesRemaining < 0) {
+            bytesRemaining = 0;
+        }
+        
         thedata = new byte[bytesRemaining];
         System.arraycopy( data, offset + 8, thedata, 0, bytesRemaining );
         return bytesRemaining + 8;