Bug 61059

Summary: [PATCH] Fix incorrect use of short when unsigned short was required in NamePtg
Product: POI Reporter: Travis Burtrum <admin.apache>
Component: SS CommonAssignee: POI Developers List <dev>
Status: RESOLVED FIXED    
Severity: blocker Keywords: PatchAvailable
Priority: P2    
Version: unspecified   
Target Milestone: ---   
Hardware: PC   
OS: Linux   
Attachments: 0001-Fix-incorrect-use-of-short-when-unsigned-short-was-r.patch

Description Travis Burtrum 2017-05-01 20:06:39 UTC
Created attachment 34967 [details]
0001-Fix-incorrect-use-of-short-when-unsigned-short-was-r.patch

A large spreadsheet (my guess is > 32k rows) crashes in the FormulaEvaluator.evaluate(Cell) function with this error:


java.lang.ArrayIndexOutOfBoundsException: -32760
	at java.util.ArrayList.elementData(ArrayList.java:418) ~[na:1.8.0_121]
	at java.util.ArrayList.get(ArrayList.java:431) ~[na:1.8.0_121]
	at org.apache.poi.hssf.model.LinkTable.getNameRecord(LinkTable.java:321) ~[poi-3.16.jar:3.16]
	at org.apache.poi.hssf.model.InternalWorkbook.getNameRecord(InternalWorkbook.java:1660) ~[poi-3.16.jar:3.16]
	at org.apache.poi.hssf.usermodel.HSSFEvaluationWorkbook.getName(HSSFEvaluationWorkbook.java:220) ~[poi-3.16.jar:3.16]
	at org.apache.poi.ss.formula.WorkbookEvaluator.getEvalForPtg(WorkbookEvaluator.java:616) ~[poi-3.16.jar:3.16]
	at org.apache.poi.ss.formula.WorkbookEvaluator.evaluateFormula(WorkbookEvaluator.java:525) ~[poi-3.16.jar:3.16]
	at org.apache.poi.ss.formula.WorkbookEvaluator.evaluateAny(WorkbookEvaluator.java:290) ~[poi-3.16.jar:3.16]
	at org.apache.poi.ss.formula.WorkbookEvaluator.evaluate(WorkbookEvaluator.java:232) ~[poi-3.16.jar:3.16]
	at org.apache.poi.hssf.usermodel.HSSFFormulaEvaluator.evaluateFormulaCellValue(HSSFFormulaEvaluator.java:200) ~[poi-3.16.jar:3.16]
	at org.apache.poi.ss.formula.BaseFormulaEvaluator.evaluate(BaseFormulaEvaluator.java:101) ~[poi-3.16.jar:3.16]

I tracked down the bug in org.apache.poi.ss.formula.ptg.NamePtg line 47:

field_1_label_index = in.readShort();

Changing that to

field_1_label_index = in.readUShort();

Fixes the problem.  I *think* that is the *right* fix, but you guys might know better.
Comment 1 Javen O'Neal 2017-05-01 21:23:16 UTC
Does this value need to be written out as a ushort as well?
Comment 2 Javen O'Neal 2017-05-01 21:50:28 UTC
Are you able to share the problematic workbook for inclusion in our unit test suite? Otherwise we could write some unit test code to generate a workbook and check for this AIOOBE. Are you able to figure out what formula string triggered this exception? Does your workbook have greater than 32767 names in the NameManager?
Comment 3 Javen O'Neal 2017-05-01 21:54:46 UTC
(In reply to Javen O'Neal from comment #1)
> Does this value need to be written out as a ushort as well?

Disregard this question. It looks like the signed/unsigned differentiation is only made when reading the value. Signed and unsigned shorts have the same binary representation.
Comment 4 Javen O'Neal 2017-05-28 01:19:44 UTC
Applied in r1796466 without a unit test.

These changes will be available in POI 3.17 beta 1.

If anyone can provide a supporting document or unit test to make sure this stays fixed in the future, please reopen this bug and attach the info.