Bug 50539

Summary: Error reading in a vml file with unmatched <br>
Product: POI Reporter: Jay Walters <jwalters>
Component: XSSFAssignee: POI Developers List <dev>
Status: RESOLVED FIXED    
Severity: normal    
Priority: P2    
Version: 3.7-FINAL   
Target Milestone: ---   
Hardware: PC   
OS: Windows XP   
Attachments: VML file illustrating the problem
Patch to resolve the issue and unit test the fix

Description Jay Walters 2011-01-03 11:48:05 UTC
Created attachment 26454 [details]
VML file illustrating the problem

In the EvilUnclosedBRFixingInputStream.java file, it does not properly handle a case where there is a <br> in the overflow part of the buffer. It throws a NegativeArraySizeException.

The fixup function needs to not process <br> tags past the end of the shortened buffer, and when returning the spare bytes it needs to run fixup.

You can process the attached VML file through the EvilUnclosedBRFixingInputStream to reproduce the exception.
Comment 1 Jay Walters 2011-01-03 16:13:19 UTC
Created attachment 26456 [details]
Patch to resolve the issue and unit test the fix

Includes the changes to EvilUnclosedBRFixingInputStream and to its unit test to verify the problem is resolved.
Comment 2 Nick Burch 2011-02-04 11:44:00 UTC
Thanks for the patch and unit test

After some pondering, I decided to refactor the class and fix a bit to make it clearer what is going on. I tweaked the test to try a wide range of buffer sizes, to simulate all the different cases of the br in the overflow, and it now passes all of them.

Fix committed in r1067217.