========================================================================================
For class org.apache.poi.hwpf.sprm.SprmOperation:

method edited
public int getOperand()
  {
    switch (_sizeCode)
    {
      case 0:
      case 1:
        return _grpprl[_gOffset];
      case 2:
      case 4:
      case 5:
        return LittleEndian.getShort(_grpprl, _gOffset);
      case 3:
        return LittleEndian.getInt(_grpprl, _gOffset);
      case 6:
	//ORIGINAL
        //throw new UnsupportedOperationException("This SPRM contains a variable length operand");

	//MINE
    	  byte operandLength = _grpprl[_gOffset + 1];   //surely shorter than an int...
    	  
    	  
    	  byte [] codeBytes = new byte[LittleEndian.INT_SIZE]; //initialized to zeros by JVM
    	  for(int i = 0; i < operandLength; i++)
    		  if(_gOffset + i < _grpprl.length)
    			  codeBytes[i] = _grpprl[_gOffset + 1 + i];

    	  return LittleEndian.getInt(codeBytes, 0);
      case 7:
        byte threeByteInt[] = new byte[4];
        threeByteInt[0] = _grpprl[_gOffset];
        threeByteInt[1] = _grpprl[_gOffset + 1];
        threeByteInt[2] = _grpprl[_gOffset + 2];
        threeByteInt[3] = (byte)0;
        return LittleEndian.getInt(threeByteInt, 0);
      default:
        throw new IllegalArgumentException("SPRM contains an invalid size code");
    }
  }


========================================================================================
For class org.apache.poi.util.LittleEndian:


method edited (to avoid ArrayIndexOutOfBoundException if the array is shorter than requested)
    private static long getNumber(final byte[] data, final int offset,
            final int size) {
        long result = 0;

        for (int j = offset + size - 1; j >= offset; j--) {
            
            /******mine***********/
            if(j < data.length)
            {
            /******mine, end******/
        		result <<= 8;
        		result |= 0xff & data[j];
            /******mine***********/
            }
            /******mine, end******/
        }
        return result;
    }