Bug 61911: Avoid IndexOutOfBounds access when reading pictures

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1819403 13f79535-47bb-0310-9956-ffa450edef68

2 files changed, 30 insertions, 4 deletions

diff --git a/src/scratchpad/src/org/apache/poi/hwpf/model/StyleSheet.java b/src/scratchpad/src/org/apache/poi/hwpf/model/StyleSheet.java
index 4f057fb3aa..8811bfb1f0 100644
--- a/src/scratchpad/src/org/apache/poi/hwpf/model/StyleSheet.java
+++ b/src/scratchpad/src/org/apache/poi/hwpf/model/StyleSheet.java
@@ -304,6 +304,10 @@ public final class StyleSheet {
             return NIL_CHP;
         }
 
+        if (styleIndex == -1) {
+            return NIL_CHP;
+        }
+
         return (_styleDescriptions[styleIndex] != null ? _styleDescriptions[styleIndex]
                 .getCHP() : NIL_CHP);
     }
@@ -318,6 +322,10 @@ public final class StyleSheet {
             return NIL_PAP;
         }
 
+        if (styleIndex == -1) {
+            return NIL_PAP;
+        }
+
         if (_styleDescriptions[styleIndex] == null) {
             return NIL_PAP;
         }
@@ -338,6 +346,10 @@ public final class StyleSheet {
             return NIL_CHPX;
         }
 
+        if (styleIndex == -1) {
+            return NIL_CHPX;
+        }
+
         if (_styleDescriptions[styleIndex] == null) {
             return NIL_CHPX;
         }
@@ -358,6 +370,10 @@ public final class StyleSheet {
             return NIL_PAPX;
         }
 
+        if (styleIndex == -1) {
+            return NIL_PAPX;
+        }
+
         if (_styleDescriptions[styleIndex] == null) {
             return NIL_PAPX;
         }
diff --git a/src/scratchpad/testcases/org/apache/poi/hwpf/usermodel/TestBugs.java b/src/scratchpad/testcases/org/apache/poi/hwpf/usermodel/TestBugs.java
index 4ba83bb767..4bced587d4 100644
--- a/src/scratchpad/testcases/org/apache/poi/hwpf/usermodel/TestBugs.java
+++ b/src/scratchpad/testcases/org/apache/poi/hwpf/usermodel/TestBugs.java
@@ -38,10 +38,7 @@ import org.apache.poi.hwpf.converter.AbstractWordUtils;
 import org.apache.poi.hwpf.converter.WordToTextConverter;
 import org.apache.poi.hwpf.extractor.Word6Extractor;
 import org.apache.poi.hwpf.extractor.WordExtractor;
-import org.apache.poi.hwpf.model.FieldsDocumentPart;
-import org.apache.poi.hwpf.model.FileInformationBlock;
-import org.apache.poi.hwpf.model.PlexOfField;
-import org.apache.poi.hwpf.model.SubdocumentType;
+import org.apache.poi.hwpf.model.*;
 import org.apache.poi.poifs.filesystem.NPOIFSFileSystem;
 import org.apache.poi.poifs.filesystem.POIFSFileSystem;
 import org.apache.poi.util.IOUtils;
@@ -903,4 +900,17 @@ public class TestBugs{
         HWPFDocument document = HWPFTestDataSamples.openSampleFile("ca.kwsymphony.www_education_School_Concert_Seat_Booking_Form_2011-12.doc");
         document.close();
     }
+
+    @Test
+    public void test61911() throws IOException {
+        HWPFDocument document = HWPFTestDataSamples.openSampleFile("61911.doc");
+
+        PicturesTable picturesTable = document.getPicturesTable();
+        List<Picture> pictures = picturesTable.getAllPictures();
+        assertNotNull(pictures);
+        assertEquals(0, pictures.size());
+
+        document.close();
+
+    }
 }