Bug 59135 - Password gets truncated when using passwords longer than 15 characters for the function protectSheet()
Summary: Password gets truncated when using passwords longer than 15 characters for th...
Status: RESOLVED FIXED
Alias: None
Product: POI
Classification: Unclassified
Component: HSSF (show other bugs)
Version: 3.14-dev
Hardware: PC All
: P2 normal (vote)
Target Milestone: ---
Assignee: POI Developers List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-07 15:52 UTC by Dirk Lang
Modified: 2016-03-13 19:32 UTC (History)
0 users



Attachments
Example Program to demonstrate the problem (824 bytes, text/plain)
2016-03-07 15:52 UTC, Dirk Lang
Details
CreatePasswordVerifier_Method1 with more than 15 chars (8.14 KB, patch)
2016-03-08 01:10 UTC, Andreas Beeker
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dirk Lang 2016-03-07 15:52:17 UTC
Created attachment 33643 [details]
Example Program to demonstrate the problem

When using passwords longer 15 characters for the function protectSheet() the password gets truncated at position 15 and the rest of the password is not used.
This causes problems when you try to remove the Sheet protection in Excel using the original Password. Using Poi 3.10 using passwords longer than 15 characters was no problem

Attached please find a test program to check this issue.

best regards
Dirk
Comment 1 Andreas Beeker 2016-03-08 01:10:36 UTC
Created attachment 33646 [details]
CreatePasswordVerifier_Method1 with more than 15 chars

Thanks for pointing this out ... I've missed that the method1 functions take arbitrary length strings, whereas method2 functions are limited to 15 chars. (see MS-OFFCRYPTO - 2.3.7.* for more details)

This is a quick hack ... I'll apply it when I have applied all the other patches, which pile up since the last few weeks and little bit more testing is needed too. Furthermore I need to investigate why there's no implementation for EncryptData_Method1, this would be probably only needed for HWPF Xor obfuscation.

Andi
Comment 2 Andreas Beeker 2016-03-13 19:32:29 UTC
applied via r1734843