ASF Bugzilla – Attachment 26456 Details for
Bug 50539
Error reading in a vml file with unmatched <br>
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch to resolve the issue and unit test the fix
mypatch.patch (text/plain), 5.01 KB, created by
Jay Walters
on 2011-01-03 16:13:19 UTC
(
hide
)
Description:
Patch to resolve the issue and unit test the fix
Filename:
MIME Type:
Creator:
Jay Walters
Created:
2011-01-03 16:13:19 UTC
Size:
5.01 KB
patch
obsolete
>Index: src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java >=================================================================== >--- src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java (revision 1054688) >+++ src/ooxml/java/org/apache/poi/xssf/util/EvilUnclosedBRFixingInputStream.java (working copy) >@@ -59,6 +59,8 @@ > System.arraycopy(spare, 0, b, off, spare.length); > int ret = spare.length; > spare = null; >+ // Need to do a fixup here >+ ret = fixUp(b, off, ret); > return ret; > } > >@@ -73,11 +75,11 @@ > } > > private int fixUp(byte[] b, int offset, int read) { >- // Find places to fix >+ // Find places to fix, including partials at the end > ArrayList<Integer> fixAt = new ArrayList<Integer>(); >- for(int i=offset; i<offset+read-4; i++) { >+ for(int i=offset; i<offset+read; i++) { > boolean going = true; >- for(int j=0; j<detect.length && going; j++) { >+ for(int j=0; j<detect.length && i+j< read && going; j++) { > if(b[i+j] != detect[j]) { > going = false; > } >@@ -87,13 +89,43 @@ > } > } > >+ // Nothing at all to fix > if(fixAt.size()==0) { > return read; > } > >- // Save a bit, if needed to fit >- int overshoot = offset+read+fixAt.size() - b.length; >+ // We have 4 cases here >+ // #1 Buffer is too small and we have a split >+ // #2 Buffer is too small and no splits >+ // #3 Buffer is big enough but we have a split >+ // #4 Buffer is big enough and no splits >+ // First we check if the buffer is too small or not >+ int overshoot = Math.max(offset+read+fixAt.size() - b.length, 0); > if(overshoot > 0) { >+ // Buffer is too small so check for a split >+ int end = b.length - overshoot; >+ for (int i = fixAt.size()-1; i >= 0; --i) { >+ int pos = fixAt.get(i); >+ if (pos > (end - detect.length)) { >+ // we have a split >+ overshoot += (pos - (end - detect.length)); >+ } else if (pos < (end - detect.length)) break; >+ } >+ } else { >+ // Buffer is big enough, but check for a split >+ int end = b.length; >+ for (int i = fixAt.size()-1; i >= 0; --i) { >+ int pos = fixAt.get(i); >+ if (pos > (end - detect.length)) { >+ // we have a split >+ overshoot += (pos - (end - detect.length)); >+ } else if (pos < (end - detect.length)) break; >+ } >+ } >+ >+ if (overshoot > 0) { >+ // We need to take a bit out of the buffer so we have space to >+ // insert the / into the <br> tag, or skip a partial <br> > spare = new byte[overshoot]; > System.arraycopy(b, b.length-overshoot, spare, 0, overshoot); > read -= overshoot; >@@ -103,8 +135,9 @@ > // positions are valid > for(int j=fixAt.size()-1; j>=0; j--) { > int i = fixAt.get(j); >- >- byte[] tmp = new byte[read-i-3]; >+ int xpos = read - i - 3; >+ if (xpos < 0) continue; >+ byte[] tmp = new byte[xpos]; > System.arraycopy(b, i+3, tmp, 0, tmp.length); > b[i+3] = (byte)'/'; > System.arraycopy(tmp, 0, b, i+4, tmp.length); >Index: src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java >=================================================================== >--- src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java (revision 1054681) >+++ src/ooxml/testcases/org/apache/poi/xssf/util/TestEvilUnclosedBRFixingInputStream.java (working copy) >@@ -70,6 +70,39 @@ > assertEquals(fixed, result); > } > >+ public void testBufferSize() throws Exception { >+ byte[] orig_root = "<p><div>Hello<br>There!</div> <div>Tags!<br></div></p>".getBytes("UTF-8"); >+ byte[] fixed_root = "<p><div>Hello<br/>There!</div> <div>Tags!<br/></div></p>".getBytes("UTF-8"); >+ >+ ByteArrayOutputStream origStream = new ByteArrayOutputStream(); >+ ByteArrayOutputStream fixedStream = new ByteArrayOutputStream(); >+ for (; fixedStream.size() < 2048 + fixed_root.length; ) { >+ fixedStream.write(fixed_root, 0, fixed_root.length); >+ origStream.write(orig_root, 0, orig_root.length); >+ } >+ byte[] orig = origStream.toByteArray(); >+ byte[] fixed = fixedStream.toByteArray(); >+ >+ EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream( >+ new ByteArrayInputStream(orig) >+ ); >+ >+ ByteArrayOutputStream bout = new ByteArrayOutputStream(); >+ boolean going = true; >+ while(going) { >+ byte[] b = new byte[1024]; >+ int r = inp.read(b); >+ if(r > 0) { >+ bout.write(b, 0, r); >+ } else { >+ going = false; >+ } >+ } >+ >+ byte[] result = bout.toByteArray(); >+ assertEquals(fixed, result); >+ } >+ > protected void assertEquals(byte[] a, byte[] b) { > assertEquals(a.length, b.length); > for(int i=0; i<a.length; i++) {
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 50539
:
26454
| 26456