Bug 42726 - java.lang.NegativeArraySizeException in VariantSupport.read
Summary: java.lang.NegativeArraySizeException in VariantSupport.read
Status: RESOLVED DUPLICATE of bug 45583
Alias: None
Product: POI
Classification: Unclassified
Component: HPSF (show other bugs)
Version: 3.0-FINAL
Hardware: Other Linux
: P2 normal (vote)
Target Milestone: ---
Assignee: POI Developers List
Depends on:
Reported: 2007-06-22 20:31 UTC by David Herring
Modified: 2009-08-20 06:50 UTC (History)
0 users

Input file (2.12 KB, application/octet-stream)
2007-06-22 20:40 UTC, David Herring

Note You need to log in before you can comment on or make changes to this bug.
Description David Herring 2007-06-22 20:31:41 UTC
I downloaded poi-3.0-rc4 created a simple xls file using OpenOffice started
org/apache/poi/hpsf/examples/CopyCompare passing the example xls on the command
line. This resulted in jvm termination with java.lang.NegativeArraySizeException
 thrown from line 251 of VariantSupport.java

Running CopyCompare in the eclipse debugger I see that
org/apache/poi/hwpf/usermodel/Section.java assigns a negative value to
ple.length and passes it to new Property which winds up in VariantSupport
which in turn tries to size an array based on this negative value.

Stack Trace:

Exception in thread "main" java.lang.NegativeArraySizeException
	at org.apache.poi.hpsf.VariantSupport.read(VariantSupport.java:251)
	at org.apache.poi.hpsf.Property.<init>(Property.java:163)
	at org.apache.poi.hpsf.Section.<init>(Section.java:281)
	at org.apache.poi.hpsf.PropertySet.init(PropertySet.java:454)
	at org.apache.poi.hpsf.PropertySet.<init>(PropertySet.java:249)
	at org.apache.poi.hpsf.PropertySetFactory.create(PropertySetFactory.java:61)
	at org.apache.poi.poifs.eventfilesystem.POIFSReader.read(POIFSReader.java:97)
	at org.apache.poi.hpsf.examples.CopyCompare.main(CopyCompare.java:139)
Comment 1 David Herring 2007-06-22 20:40:52 UTC
Created attachment 20391 [details]
Input file

The file (bzipped) which caused the exception
Comment 2 Rainer Klute 2007-06-22 22:19:48 UTC
Will have a look at it.
Comment 3 Rainer Klute 2007-06-23 00:54:13 UTC
The error is in the data: property set stream is larger than it claims to be. I
added a consistency check to the code base which throws an appropriate
exception. If you generated your file with a recent OpenOffice.org release, you
should file a bug report for it.
Comment 4 Yegor Kozlov 2009-08-20 06:50:33 UTC

*** This bug has been marked as a duplicate of bug 45583 ***