You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by ce...@apache.org on 2021/12/30 23:04:16 UTC
svn commit: r1896555 - /poi/trunk/poi/src/main/java/org/apache/poi/hssf/record/RecordFactory.java
Author: centic
Date: Thu Dec 30 23:04:16 2021
New Revision: 1896555
URL: http://svn.apache.org/viewvc?rev=1896555&view=rev
Log:
Limit the maximum number of records that are read for an XLS
To avoid unexpected behavior on some corrupted input-data
Modified:
poi/trunk/poi/src/main/java/org/apache/poi/hssf/record/RecordFactory.java
Modified: poi/trunk/poi/src/main/java/org/apache/poi/hssf/record/RecordFactory.java
URL: http://svn.apache.org/viewvc/poi/trunk/poi/src/main/java/org/apache/poi/hssf/record/RecordFactory.java?rev=1896555&r1=1896554&r2=1896555&view=diff
==============================================================================
--- poi/trunk/poi/src/main/java/org/apache/poi/hssf/record/RecordFactory.java (original)
+++ poi/trunk/poi/src/main/java/org/apache/poi/hssf/record/RecordFactory.java Thu Dec 30 23:04:16 2021
@@ -22,6 +22,7 @@ import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
+import org.apache.poi.util.IOUtils;
import org.apache.poi.util.RecordFormatException;
/**
@@ -33,6 +34,9 @@ import org.apache.poi.util.RecordFormatE
public final class RecordFactory {
private static final int NUM_RECORDS = 512;
+ // how many records we read at max by default (can be adjusted via IOUtils)
+ private static final int MAX_NUMBER_OF_RECORDS = 1_000_000;
+
private RecordFactory() {}
/**
@@ -105,12 +109,13 @@ public final class RecordFactory {
* @return the equivalent array of {@link NumberRecord NumberRecords}
*/
public static NumberRecord[] convertRKRecords(MulRKRecord mrk) {
- if (mrk.getNumColumns() < 0) {
- throw new RecordFormatException("Cannot create RKRecords with negative number of columns: " + mrk.getNumColumns());
+ int numColumns = mrk.getNumColumns();
+ if (numColumns < 0) {
+ throw new RecordFormatException("Cannot create RKRecords with negative number of columns: " + numColumns);
}
- NumberRecord[] mulRecs = new NumberRecord[mrk.getNumColumns()];
- for (int k = 0; k < mrk.getNumColumns(); k++) {
+ NumberRecord[] mulRecs = new NumberRecord[numColumns];
+ for (int k = 0; k < numColumns; k++) {
NumberRecord nr = new NumberRecord();
nr.setColumn((short) (k + mrk.getFirstColumn()));
@@ -171,6 +176,8 @@ public final class RecordFactory {
Record record;
while ((record = recStream.nextRecord())!=null) {
records.add(record);
+
+ IOUtils.safelyAllocateCheck(records.size(), MAX_NUMBER_OF_RECORDS);
}
return records;
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org