You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by fa...@apache.org on 2026/09/01 09:40:01 UTC
(poi) branch trunk updated: Restore sized reads for known zip entry sizes while capping the initial allocation (#1235)
This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new 8e06374bd0 Restore sized reads for known zip entry sizes while capping the initial allocation (#1235)
8e06374bd0 is described below
commit 8e06374bd0d3aa916c2cbd4e701d4843c1ded570
Author: PJ Fanning <pj...@users.noreply.github.com>
AuthorDate: Tue Sep 1 10:39:55 2026 +0100
Restore sized reads for known zip entry sizes while capping the initial allocation (#1235)
* Restore sized reads for known zip entry sizes while capping the initial allocation
The change in #1227 made ZipArchiveFakeEntry read every in-memory entry via
IOUtils.toByteArrayWithMaxLength, which starts from a 4KB buffer and grows by
doubling. For larger entries that produces a cascade of reallocations and
short-lived garbage arrays; with poi-integration running tests in parallel this
regressed heap usage badly enough to cause OutOfMemoryError on CI.
Restore the exactly-sized single allocation for entries with a known declared
size, while keeping #1227's protection against untrusted size fields:
- New IOUtils.toByteArray overload takes a maxInitBufferSize that caps the
initial buffer allocation; the buffer still grows as real data arrives,
bounded by length/maxLength. Existing overloads are unchanged.
- ZipArchiveFakeEntry uses it with a 2MB cap: entries up to 2MB (the vast
majority) get one exactly-sized allocation, larger ones grow from a 2MB
base, and a bogus huge declared size can force at most a 2MB eager
allocation.
- Reads are bounded by the declared entry size again: an entry holding fewer
bytes than declared fails with EOFException (as before #1227), and an entry
holding more bytes than declared is now rejected with an IOException instead
of the extra bytes being read.
The stricter size validation changes which exception 20 corrupt fuzz files in
the poi-integration corpus surface (they all declare entry sizes smaller than
the data actually present); the expected exceptions were re-derived by running
each handler against each file.
Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
* Update direct tests of fuzz files affected by the zip entry size validation
Five tests open corrupt fuzz files whose zip entries hold more data than
their declared size; these files are now rejected while reading the package
instead of opening. Update the tests to assert the rejection. The downstream
behaviours they previously exercised (null numbering/settings handling,
broken shared strings table, failing write) can no longer be reached with
these files.
Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <no...@anthropic.com>
---
.../org/apache/poi/integration/TestXLSX2CSV.java | 21 +++-----
.../poi/openxml4j/util/ZipArchiveFakeEntry.java | 31 +++++++++---
.../openxml4j/util/TestZipArchiveFakeEntry.java | 48 +++++++++++++++---
.../TestReadOnlySharedStringsTable.java | 20 +++-----
.../poi/xssf/streaming/TestSXSSFWorkbook.java | 14 +++---
.../poi/xssf/usermodel/TestXSSFVMLDrawing.java | 16 +++---
.../poi/xwpf/usermodel/TestXWPFNumbering.java | 20 +++-----
poi/src/main/java/org/apache/poi/util/IOUtils.java | 50 ++++++++++++++++++-
.../test/java/org/apache/poi/util/TestIOUtils.java | 30 +++++++++++
test-data/poi-integration-exceptions.csv | 58 ++++++++--------------
10 files changed, 202 insertions(+), 106 deletions(-)
diff --git a/poi-examples/src/test/java/org/apache/poi/integration/TestXLSX2CSV.java b/poi-examples/src/test/java/org/apache/poi/integration/TestXLSX2CSV.java
index ec26a739e1..6cf9d54618 100644
--- a/poi-examples/src/test/java/org/apache/poi/integration/TestXLSX2CSV.java
+++ b/poi-examples/src/test/java/org/apache/poi/integration/TestXLSX2CSV.java
@@ -29,7 +29,7 @@ import java.nio.charset.StandardCharsets;
import org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream;
import org.apache.poi.examples.xssf.eventusermodel.XLSX2CSV;
-import org.apache.poi.ooxml.POIXMLException;
+import org.apache.poi.openxml4j.exceptions.InvalidOperationException;
import org.apache.poi.openxml4j.opc.OPCPackage;
import org.apache.poi.openxml4j.opc.PackageAccess;
import org.apache.poi.xssf.XSSFTestDataSamples;
@@ -103,21 +103,16 @@ public class TestXLSX2CSV {
@Test
public void testInvalidSampleFile() throws Exception {
- final UnsynchronizedByteArrayOutputStream outputBytes = UnsynchronizedByteArrayOutputStream.builder().get();
- PrintStream out = new PrintStream(outputBytes, true, StandardCharsets.UTF_8.name());
-
- // The package open is instantaneous, as it should be.
- try (OPCPackage p = OPCPackage.open(XSSFTestDataSamples.getSampleFile("clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx").getAbsolutePath(), PackageAccess.READ)) {
- XLSX2CSV xlsx2csv = new XLSX2CSV(p, out, -1);
- assertThrows(POIXMLException.class,
- xlsx2csv::process);
- }
+ // this malformed package used to open and then fail in process() - the zip entry size
+ // validation now rejects it at open time (an entry holds more data than its declared
+ // size; the broken central directory forces the stream-based fallback which reads the
+ // entries eagerly)
+ InvalidOperationException ex = assertThrows(InvalidOperationException.class, () ->
+ OPCPackage.open(XSSFTestDataSamples.getSampleFile("clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx").getAbsolutePath(), PackageAccess.READ));
+ assertContains(ex.getCause().getMessage(), "more data than its declared size");
String errorOutput = errorBytes.toString(StandardCharsets.UTF_8);
assertEquals("", errorOutput);
-
- String output = outputBytes.toString(StandardCharsets.UTF_8);
- assertEquals("", output, "Had: " + output);
}
@Test
diff --git a/poi-ooxml/src/main/java/org/apache/poi/openxml4j/util/ZipArchiveFakeEntry.java b/poi-ooxml/src/main/java/org/apache/poi/openxml4j/util/ZipArchiveFakeEntry.java
index 68e37012f1..83c581b9f3 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/openxml4j/util/ZipArchiveFakeEntry.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/openxml4j/util/ZipArchiveFakeEntry.java
@@ -43,6 +43,13 @@ public final class ZipArchiveFakeEntry extends ZipArchiveEntry implements Closea
private static final int DEFAULT_MAX_ENTRY_SIZE = 100_000_000;
private static int MAX_ENTRY_SIZE = DEFAULT_MAX_ENTRY_SIZE;
+ // cap on the initial read-buffer allocation for entries with a known size. The declared
+ // entry size comes from the (untrusted) zip local file header, so we do not eagerly
+ // allocate more than this from it - the buffer grows beyond it only as real data arrives.
+ // Deliberately well below DEFAULT_MAX_ENTRY_SIZE; entries up to this size (the vast
+ // majority) are still read with a single exactly-sized allocation.
+ private static final int MAX_INIT_BUFFER_SIZE = 2_000_000;
+
/**
* Set the maximum size of a single entry in a zip-file.
* @param maxEntrySize number of bytes at which a zip entry is regarded as too large for holding in memory
@@ -102,12 +109,24 @@ public final class ZipArchiveFakeEntry extends ZipArchiveEntry implements Closea
}
// Grab the de-compressed contents for later.
- // Note: we deliberately do not use the declared entrySize to size the read buffer.
- // entrySize comes from the (untrusted) zip local file header, so a tiny entry can
- // claim a huge uncompressed size and force a large eager allocation before any data
- // is read. Instead read what is actually present, growing as needed and bounded by
- // getMaxEntrySize() (a stream longer than that fails with a RecordFormatException).
- data = IOUtils.toByteArrayWithMaxLength(inp, getMaxEntrySize());
+ if (entrySize == -1) {
+ // size unknown: read what is present, bounded by getMaxEntrySize()
+ // (a stream longer than that fails with a RecordFormatException)
+ data = IOUtils.toByteArrayWithMaxLength(inp, getMaxEntrySize());
+ } else {
+ // size known: read exactly entrySize bytes (EOFException if the entry holds
+ // fewer). The initial buffer is sized from entrySize but capped at
+ // MAX_INIT_BUFFER_SIZE - entrySize comes from the (untrusted) zip local file
+ // header, so a tiny entry claiming a huge uncompressed size must not be able
+ // to force a large eager allocation before any data is read.
+ data = IOUtils.toByteArray(inp, Math.toIntExact(entrySize), getMaxEntrySize(),
+ MAX_INIT_BUFFER_SIZE, "ZipArchiveFakeEntry.setMaxEntrySize()");
+ // the entry must not hold more bytes than it declared
+ if (inp.read() >= 0) {
+ throw new IOException("Zip entry " + entry.getName()
+ + " has more data than its declared size of " + entrySize + " bytes");
+ }
+ }
numberOfBytes = data.length;
}
}
diff --git a/poi-ooxml/src/test/java/org/apache/poi/openxml4j/util/TestZipArchiveFakeEntry.java b/poi-ooxml/src/test/java/org/apache/poi/openxml4j/util/TestZipArchiveFakeEntry.java
index cb1dcbcdf1..a3a8e6bddf 100644
--- a/poi-ooxml/src/test/java/org/apache/poi/openxml4j/util/TestZipArchiveFakeEntry.java
+++ b/poi-ooxml/src/test/java/org/apache/poi/openxml4j/util/TestZipArchiveFakeEntry.java
@@ -24,12 +24,14 @@ import org.apache.poi.util.RecordFormatException;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.parallel.Isolated;
+import java.io.EOFException;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
@Isolated // changes static values, so other tests should not run at the same time
public class TestZipArchiveFakeEntry {
@@ -61,21 +63,17 @@ public class TestZipArchiveFakeEntry {
}
@Test
- void testEntrySizeLargerThanData() throws IOException {
- // A malicious zip local file header can declare a huge uncompressed size while the entry
- // actually contains only a few bytes. We must not trust that declared size to size the
- // read buffer (that would allow a tiny input to trigger a large eager allocation).
- // Instead the actual bytes present are read, bounded by getMaxEntrySize().
- final long fakeLen = 99_000_000;
+ void testKnownEntrySize() throws IOException {
+ // an entry whose declared size matches the data reads with a single exactly-sized buffer
final String fakeValue = "fakeValue";
+ final byte[] data = fakeValue.getBytes(StandardCharsets.UTF_8);
ZipArchiveEntry entry = new ZipArchiveEntry("hack123") {
@Override
public long getSize() {
- return fakeLen;
+ return data.length;
}
};
UnsynchronizedByteArrayOutputStream baos = UnsynchronizedByteArrayOutputStream.builder().get();
- final byte[] data = fakeValue.getBytes(StandardCharsets.UTF_8);
baos.write(data);
try (ZipArchiveFakeEntry zipArchiveFakeEntry = new ZipArchiveFakeEntry(entry, baos.toInputStream())) {
assertEquals(data.length, zipArchiveFakeEntry.getSize());
@@ -87,6 +85,40 @@ public class TestZipArchiveFakeEntry {
}
}
+ @Test
+ void testEntrySizeLargerThanData() {
+ // A malicious zip local file header can declare a huge uncompressed size while the entry
+ // actually contains only a few bytes. The declared size must not be trusted to size the
+ // read buffer (the initial allocation is capped well below getMaxEntrySize()), and an
+ // entry holding fewer bytes than declared is rejected.
+ final long fakeLen = 99_000_000;
+ ZipArchiveEntry entry = new ZipArchiveEntry("hack123") {
+ @Override
+ public long getSize() {
+ return fakeLen;
+ }
+ };
+ UnsynchronizedByteArrayOutputStream baos = UnsynchronizedByteArrayOutputStream.builder().get();
+ baos.write("fakeValue".getBytes(StandardCharsets.UTF_8), 0, 9);
+ assertThrows(EOFException.class, () -> new ZipArchiveFakeEntry(entry, baos.toInputStream()));
+ }
+
+ @Test
+ void testEntrySizeSmallerThanData() {
+ // an entry holding more bytes than its declared size is rejected rather than read past
+ // the declared size
+ ZipArchiveEntry entry = new ZipArchiveEntry("hack123") {
+ @Override
+ public long getSize() {
+ return 4;
+ }
+ };
+ UnsynchronizedByteArrayOutputStream baos = UnsynchronizedByteArrayOutputStream.builder().get();
+ baos.write("fakeValue".getBytes(StandardCharsets.UTF_8), 0, 9);
+ IOException ex = assertThrows(IOException.class, () -> new ZipArchiveFakeEntry(entry, baos.toInputStream()));
+ assertTrue(ex.getMessage().contains("more data than its declared size"), ex.getMessage());
+ }
+
@Test
void testEntryDataLargerThanMaxEntrySize() throws IOException {
// Reading is bounded by getMaxEntrySize(): a stream longer than the limit is rejected
diff --git a/poi-ooxml/src/test/java/org/apache/poi/xssf/eventusermodel/TestReadOnlySharedStringsTable.java b/poi-ooxml/src/test/java/org/apache/poi/xssf/eventusermodel/TestReadOnlySharedStringsTable.java
index bf7de93509..4e533b5ff9 100644
--- a/poi-ooxml/src/test/java/org/apache/poi/xssf/eventusermodel/TestReadOnlySharedStringsTable.java
+++ b/poi-ooxml/src/test/java/org/apache/poi/xssf/eventusermodel/TestReadOnlySharedStringsTable.java
@@ -130,19 +130,13 @@ public final class TestReadOnlySharedStringsTable {
}
@Test
- void testNullPointerException() throws Exception {
- try (OPCPackage pkg = OPCPackage.open(_ssTests.openResourceAsStream("clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx"))) {
- assertEmptySST(pkg);
- }
-
- try (OPCPackage pkg = OPCPackage.open(_ssTests.openResourceAsStream("clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx"))) {
- List<PackagePart> parts = pkg.getPartsByName(Pattern.compile("/xl/sharedStrings.xml"));
- assertEquals(1, parts.size());
-
- //noinspection resource
- assertThrows(IOException.class,
- () -> new SharedStringsTable(parts.get(0)));
- }
+ void testNullPointerException() {
+ // this malformed package used to open (with a broken shared strings table) - the zip
+ // entry size validation now rejects it while reading (an entry holds more data than
+ // its declared size)
+ IOException ex = assertThrows(IOException.class, () ->
+ OPCPackage.open(_ssTests.openResourceAsStream("clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx")));
+ assertTrue(ex.getMessage().contains("more data than its declared size"), ex.getMessage());
}
private void assertEmptySST(OPCPackage pkg) throws IOException, SAXException {
diff --git a/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java b/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java
index f2ac9c44bd..0c4b759d95 100644
--- a/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java
+++ b/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java
@@ -748,12 +748,12 @@ public final class TestSXSSFWorkbook extends BaseTestXWorkbook {
}
@Test
- void writeBrokenFile() throws IOException {
- try (final Workbook wb = _testDataProvider.openSampleWorkbook("clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx")) {
- try (OutputStream out = NullOutputStream.INSTANCE) {
- assertThrows(IllegalArgumentException.class,
- () -> wb.write(out));
- }
- }
+ void writeBrokenFile() {
+ // this malformed workbook used to open and then fail on write - the zip entry size
+ // validation now rejects it while reading (an entry holds more data than its
+ // declared size)
+ RuntimeException ex = assertThrows(RuntimeException.class,
+ () -> _testDataProvider.openSampleWorkbook("clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx"));
+ assertTrue(ex.getMessage().contains("more data than its declared size"), ex.getMessage());
}
}
diff --git a/poi-ooxml/src/test/java/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java b/poi-ooxml/src/test/java/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java
index 75fd8c4d98..bbe79ec2d5 100644
--- a/poi-ooxml/src/test/java/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java
+++ b/poi-ooxml/src/test/java/org/apache/poi/xssf/usermodel/TestXSSFVMLDrawing.java
@@ -25,6 +25,7 @@ import static org.junit.jupiter.api.Assertions.assertInstanceOf;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import java.io.ByteArrayInputStream;
@@ -49,7 +50,6 @@ import com.microsoft.schemas.vml.STStrokeJoinStyle;
import com.microsoft.schemas.vml.impl.CTShapetypeImpl;
import org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream;
import org.apache.poi.POIDataSamples;
-import org.apache.poi.ooxml.POIXMLException;
import org.apache.xmlbeans.XmlException;
import org.apache.xmlbeans.XmlObject;
import org.apache.xmlbeans.XmlOptions;
@@ -217,12 +217,12 @@ class TestXSSFVMLDrawing {
}
@Test
- void testInvalidFile() throws IOException {
- try (XSSFWorkbook workbook = openSampleWorkbook("clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx")) {
- assertNotNull(workbook);
- } catch (POIXMLException e) {
- // XML parser of IBM JDK is a bit more picky on XML in this file, so we expect it to fail there with this error
- assertContains(e.getMessage(), "Attribute name \"sheetId\" associated with an element type \"sheet\" must be followed by the ' = ' character.");
- }
+ void testInvalidFile() {
+ // this malformed workbook used to open (or fail XML parsing on IBM JDK) - the zip
+ // entry size validation now rejects it while reading (an entry holds more data than
+ // its declared size)
+ RuntimeException ex = assertThrows(RuntimeException.class,
+ () -> openSampleWorkbook("clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx"));
+ assertContains(ex.getMessage(), "more data than its declared size");
}
}
\ No newline at end of file
diff --git a/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java b/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java
index 252ab95b8f..1ada4bfed6 100644
--- a/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java
+++ b/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java
@@ -24,10 +24,8 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import java.io.IOException;
-import java.io.OutputStream;
import java.math.BigInteger;
-import org.apache.commons.io.output.NullOutputStream;
import org.apache.poi.xwpf.XWPFTestDataSamples;
import org.junit.jupiter.api.Test;
import org.openxmlformats.schemas.wordprocessingml.x2006.main.CTAbstractNum;
@@ -171,16 +169,12 @@ class TestXWPFNumbering {
}
@Test
- void testNPE() throws IOException {
- try (XWPFDocument doc = XWPFTestDataSamples.openSampleDocument("clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx");
- OutputStream out = NullOutputStream.INSTANCE) {
-
- // settings and numbering are null for this malformed document
- assertNull(doc.getNumbering());
- assertNull(doc.getSettings());
-
- assertThrows(IllegalStateException.class, () ->
- doc.write(out), "Fails because settings are not populated in this malformed document");
- }
+ void testNPE() {
+ // this malformed document used to open with null settings/numbering - the zip entry
+ // size validation now rejects it while reading (an entry holds more data than its
+ // declared size)
+ IOException ex = assertThrows(IOException.class, () ->
+ XWPFTestDataSamples.openSampleDocument("clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx"));
+ assertTrue(ex.getMessage().contains("more data than its declared size"), ex.getMessage());
}
}
diff --git a/poi/src/main/java/org/apache/poi/util/IOUtils.java b/poi/src/main/java/org/apache/poi/util/IOUtils.java
index 744fc4317a..570379fe59 100644
--- a/poi/src/main/java/org/apache/poi/util/IOUtils.java
+++ b/poi/src/main/java/org/apache/poi/util/IOUtils.java
@@ -280,6 +280,37 @@ public final class IOUtils {
maxLength, true, length != Integer.MAX_VALUE, limitMethod);
}
+ /**
+ * Reads up to {@code length} bytes from the input stream, and returns the bytes read,
+ * while capping the initial buffer allocation.
+ *
+ * <p>Use this variant when {@code length} comes from untrusted input (e.g. a size field in a
+ * file header): the initial buffer is at most {@code maxInitBufferSize} bytes, so a bogus
+ * huge declared length cannot force a large eager allocation before any data is read. The
+ * buffer still grows as needed while real data arrives, bounded by {@code length} and
+ * {@code maxLength}.</p>
+ *
+ * @param stream The byte stream of data to read.
+ * @param length The maximum length to read, use {@link Integer#MAX_VALUE} to read the stream
+ * until EOF
+ * @param maxLength if the input is equal to/longer than {@code maxLength} bytes,
+ * then throw an {@link IOException} complaining about the length.
+ * use {@link Integer#MAX_VALUE} to disable the check - if {@link #setByteArrayMaxOverride(int)} is
+ * set then that max of that value and this maxLength is used
+ * @param maxInitBufferSize the maximum initial size of the internal buffer; values <= 0 disable
+ * the cap. Reads of more than this many bytes grow the buffer as needed.
+ * @param limitMethod name of method that can be used to change the max length
+ * @return A byte array with the read bytes.
+ * @throws IOException If reading data fails or EOF is encountered too early for the given length.
+ * @throws RecordFormatException If the requested length is invalid.
+ * @since 6.0.0
+ */
+ public static byte[] toByteArray(final InputStream stream, final int length, final int maxLength,
+ final int maxInitBufferSize, final String limitMethod) throws IOException {
+ return toByteArray(stream, length, maxLength, true, length != Integer.MAX_VALUE,
+ maxInitBufferSize, limitMethod);
+ }
+
/**
* Reads the input stream, and returns the bytes read.
*
@@ -300,6 +331,12 @@ public final class IOUtils {
private static byte[] toByteArray(InputStream stream, final int length, final int maxLength,
final boolean checkEOFException, final boolean isLengthKnown,
final String limitMethod) throws IOException {
+ return toByteArray(stream, length, maxLength, checkEOFException, isLengthKnown, -1, limitMethod);
+ }
+
+ private static byte[] toByteArray(InputStream stream, final int length, final int maxLength,
+ final boolean checkEOFException, final boolean isLengthKnown,
+ final int maxInitBufferSize, final String limitMethod) throws IOException {
final int derivedMaxLength = Math.max(maxLength, BYTE_ARRAY_MAX_OVERRIDE);
if ((length != Integer.MAX_VALUE) || (derivedMaxLength != Integer.MAX_VALUE)) {
if (limitMethod != null) {
@@ -310,7 +347,7 @@ public final class IOUtils {
}
final int derivedLen = isLengthKnown && length >= 0 ? Math.min(length, derivedMaxLength) : derivedMaxLength;
- final int byteArrayInitLen = calculateByteArrayInitLength(isLengthKnown, length, derivedMaxLength);
+ final int byteArrayInitLen = calculateByteArrayInitLength(isLengthKnown, length, derivedMaxLength, maxInitBufferSize);
final int internalBufferLen = DEFAULT_BUFFER_SIZE;
try (UnsynchronizedByteArrayOutputStream baos = UnsynchronizedByteArrayOutputStream.builder().setBufferSize(byteArrayInitLen).get()) {
byte[] buffer = new byte[internalBufferLen];
@@ -338,8 +375,17 @@ public final class IOUtils {
//open for testing
static int calculateByteArrayInitLength(final boolean isLengthKnown, final int length, final int maxLength) {
+ return calculateByteArrayInitLength(isLengthKnown, length, maxLength, -1);
+ }
+
+ //open for testing
+ static int calculateByteArrayInitLength(final boolean isLengthKnown, final int length, final int maxLength,
+ final int maxInitBufferSize) {
final int derivedLen = Math.min(length, maxLength);
- final int bufferLen = isLengthKnown ? derivedLen : Math.min(DEFAULT_BUFFER_SIZE, derivedLen);
+ int bufferLen = isLengthKnown ? derivedLen : Math.min(DEFAULT_BUFFER_SIZE, derivedLen);
+ if (maxInitBufferSize > 0 && bufferLen > maxInitBufferSize) {
+ bufferLen = maxInitBufferSize;
+ }
if (MAX_BYTE_ARRAY_INIT_SIZE > 0 && bufferLen > MAX_BYTE_ARRAY_INIT_SIZE) {
return MAX_BYTE_ARRAY_INIT_SIZE;
}
diff --git a/poi/src/test/java/org/apache/poi/util/TestIOUtils.java b/poi/src/test/java/org/apache/poi/util/TestIOUtils.java
index 9c026b14d4..cf88165e43 100644
--- a/poi/src/test/java/org/apache/poi/util/TestIOUtils.java
+++ b/poi/src/test/java/org/apache/poi/util/TestIOUtils.java
@@ -229,6 +229,36 @@ final class TestIOUtils {
assertEquals(10000, IOUtils.calculateByteArrayInitLength(true, 12000, 10000));
}
+ @Test
+ void testCalculateByteArrayInitLengthWithMaxInitBufferSize() {
+ // cap applies when the (known) length exceeds it
+ assertEquals(5000, IOUtils.calculateByteArrayInitLength(true, 10000, 12000, 5000));
+ // no effect when the length is already below the cap
+ assertEquals(3000, IOUtils.calculateByteArrayInitLength(true, 3000, 12000, 5000));
+ // values <= 0 disable the cap
+ assertEquals(10000, IOUtils.calculateByteArrayInitLength(true, 10000, 12000, -1));
+ assertEquals(10000, IOUtils.calculateByteArrayInitLength(true, 10000, 12000, 0));
+ }
+
+ @Test
+ void testToByteArrayWithMaxInitBufferSize() throws IOException {
+ final byte[] array = new byte[]{1, 2, 3, 4, 5, 6, 7};
+ // a cap smaller than the read length must not change the result, only the initial allocation
+ try (ByteArrayInputStream is = new ByteArrayInputStream(array)) {
+ assertArrayEquals(array, IOUtils.toByteArray(is, array.length, 100, 2, "setByteArrayMaxOverride"));
+ }
+ // fewer bytes than the declared length still fails
+ try (ByteArrayInputStream is = new ByteArrayInputStream(array)) {
+ assertThrows(EOFException.class,
+ () -> IOUtils.toByteArray(is, array.length + 1, 100, 2, "setByteArrayMaxOverride"));
+ }
+ // length above maxLength still fails
+ try (ByteArrayInputStream is = new ByteArrayInputStream(array)) {
+ assertThrows(RecordFormatException.class,
+ () -> IOUtils.toByteArray(is, 200, 100, 2, "setByteArrayMaxOverride"));
+ }
+ }
+
@Test
void testSkipFully() throws IOException {
try (InputStream is = new FileInputStream(TMP)) {
diff --git a/test-data/poi-integration-exceptions.csv b/test-data/poi-integration-exceptions.csv
index fbefa8173d..f1ac698462 100644
--- a/test-data/poi-integration-exceptions.csv
+++ b/test-data/poi-integration-exceptions.csv
@@ -155,8 +155,7 @@ spreadsheet/protected_66115.xls,"handle,extract",,adeptia,,,
publisher/clusterfuzz-testcase-minimized-POIHPBFFuzzer-4701121678278656.pub,"handle,extract",HPBF,,java.lang.IllegalArgumentException,Had unexpected type of entry for path,
hsmf/clusterfuzz-testcase-minimized-POIHSMFFuzzer-4848576776503296.msg,"handle,extract",HSMF,,java.lang.IllegalArgumentException,Property and type of chunk did not match,
hsmf/clusterfuzz-testcase-minimized-POIHSMFFuzzer-4848576776503296.msg,extract,HPSF,,java.lang.IllegalArgumentException,Property and type of chunk did not match,
-document/clusterfuzz-testcase-minimized-POIFuzzer-6709287337197568.docx,"handle,extract",XWPF,,java.lang.IllegalArgumentException,Relation and type of document-part did not match,
-document/clusterfuzz-testcase-minimized-POIFuzzer-6709287337197568.docx,extract,OPC,,java.lang.IllegalArgumentException,Relation and type of document-part did not match,
+document/clusterfuzz-testcase-minimized-POIFuzzer-6709287337197568.docx,"handle,extract","XWPF,OPC",,java.io.IOException,has more data than its declared size,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5418937293340672.doc,"handle,extract",HWPF,,java.lang.IllegalArgumentException,Had unexpected type of entry for name,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5418937293340672.doc,extract,HPSF,,java.lang.IllegalArgumentException,Had unexpected type of entry for name,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5418937293340672.doc,additional,HPSF,,java.lang.IllegalArgumentException,name cannot be empty,
@@ -170,8 +169,8 @@ slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt,"han
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt,handle,HPSF,,org.opentest4j.AssertionFailedError,expected: <true> but was: <false>,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt,extract,HPSF,,java.lang.IllegalArgumentException,Had unexpected type of entry for name,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt,additional,HPSF,,java.lang.IndexOutOfBoundsException,Invalid position: ,
-spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx,"handle,additional",XSSF,,java.io.IOException,unable to parse shared strings table,
-spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx,extract,"XSSF,OPC",,org.xml.sax.SAXParseException,"Element type ""definedName"" must be followed",
+spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx,"handle,extract","XSSF,OPC",,java.io.IOException,has more data than its declared size,
+spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5025401116950528.xlsx,additional,XSSF,,org.apache.poi.openxml4j.exceptions.InvalidOperationException,Failed to read the file input stream from file,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-5306877435838464.ppt,handle,HSLF,,org.apache.poi.util.RecordFormatException,Tried to allocate an array of length,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-5306877435838464.ppt,"additional,handle",HPSF,,java.lang.IndexOutOfBoundsException,Block 11468800 not found,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-5306877435838464.ppt,extract,"HPSF,HSLF",,java.lang.IllegalArgumentException,Did not receive a valid drawing for sheet,
@@ -212,16 +211,15 @@ spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-6123461607817216.xlsx,h
spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5542865479270400.xlsx,"handle,extract",XSSF,,java.lang.IllegalArgumentException,Did not have a type in table-style,
spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5542865479270400.xlsx,extract,OPC,,java.lang.IllegalArgumentException,Did not have a type in table-style,
spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5542865479270400.xlsx,additional,XSSF,,org.apache.poi.ooxml.POIXMLException,Failed to find sheet package for sheetId,
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6061520554164224.docx,"handle,extract",XWPF,,org.apache.xmlbeans.XmlException,"error: Element type ""a:srgbClr"" must be followed",
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6061520554164224.docx,extract,OPC,,org.apache.xmlbeans.XmlException,"error: Element type ""a:srgbClr"" must be followed",
+document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6061520554164224.docx,"handle,extract","XWPF,OPC",,java.io.IOException,has more data than its declared size,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-6448258963341312.xlsx,"extract,additional",XSSF,,org.apache.poi.ooxml.POIXMLException,Failed to find sheet package for sheetId,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-6448258963341312.xlsx,extract,OPC,,org.apache.poi.ooxml.POIXMLException,Failed to find sheet package for sheetId,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-6448258963341312.xlsx,handle,XSSF,,java.lang.IllegalArgumentException,Could not read part,
document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-4959857092198400.docx,IGNORE,"XWPF,OPC",,,Ignored because IBM JDK has a different exception,
-spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx,extract,"XSSF,OPC",,org.apache.xmlbeans.XmlException,"error: Element type ""vt:vector"" must be followed",
-spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx,"handle,additional",XSSF,,org.apache.poi.ooxml.POIXMLException,Failed to find sheet package for,
+spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx,"handle,extract","XSSF,OPC",,java.io.IOException,has more data than its declared size,
+spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx,additional,XSSF,,org.apache.poi.openxml4j.exceptions.InvalidOperationException,Failed to read the file input stream from file,
spreadsheet/47889.xlsx,handle,XSSF,,java.lang.IndexOutOfBoundsException,Index,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6254434927378432.pptx,"handle,extract",XSLF,,java.lang.IllegalStateException,SlideMaster was not found for Name,
+slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6254434927378432.pptx,"handle,extract","XSLF,OPC",,java.io.IOException,has more data than its declared size,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5050208641482752.doc,extract,"HWPF,HPSF",,java.lang.IllegalArgumentException,Cannot process TableProperties with an empty SprmBuffer,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5050208641482752.doc,additional,HPSF,,org.apache.poi.hpsf.HPSFRuntimeException,Could not read file,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5050208641482752.doc,handle,HPSF,,org.opentest4j.AssertionFailedError,expected: <true> but was: <false>,
@@ -255,7 +253,7 @@ spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5786329142919168.xls,"a
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5786329142919168.xls,handle,HSSF,,java.lang.ArrayIndexOutOfBoundsException,There are only 0 font records,
slideshow/clusterfuzz-testcase-minimized-POIFuzzer-6411649193738240.ppt,extract,"HSLF,HPSF",,org.apache.poi.EncryptedDocumentException,cipher algorithm AES/-1 not found,
slideshow/clusterfuzz-testcase-minimized-POIFuzzer-6411649193738240.ppt,handle,HSLF,,java.io.FileNotFoundException,no such entry,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-5471515212382208.pptx,handle,XSLF,,org.apache.poi.ooxml.POIXMLException,OOXML file structure broken,
+slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-5471515212382208.pptx,"handle,extract","XSLF,OPC",,java.io.IOException,has more data than its declared size,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-4838893004128256.ppt,extract,"HSLF,HPSF",,org.apache.poi.EncryptedDocumentException,Invalid salt length,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-4838893004128256.ppt,handle,HSLF,,java.io.FileNotFoundException,no such entry,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4819588401201152.xls,extract,"HSSF,HPSF",,org.apache.poi.util.RecordFormatException,The content of an excel record cannot exceed,
@@ -265,8 +263,7 @@ spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4819588401201152.xls,ha
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4819588401201152.xls,handle,HSSF,,org.apache.poi.util.RecordFormatException,The content of an excel record cannot exceed,
diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6358126418591744.vsdx,"handle,extract",XDGF,,java.lang.IllegalStateException,Could not read relation for page settings,
diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6358126418591744.vsdx,extract,OPC,,java.lang.IllegalStateException,Could not read relation for page settings,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5981064948219904.vsdx,extract,"XDGF,OPC",,java.io.IOException,org.apache.poi.ooxml.POIXMLException,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5981064948219904.vsdx,handle,XDGF,,org.apache.poi.ooxml.POIXMLException,/visio/masters/masters.xml,
+diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5981064948219904.vsdx,"handle,extract","XDGF,OPC",,java.io.IOException,has more data than its declared size,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls,extract,"HSSF,HPSF",,java.lang.IllegalArgumentException,Had unexpected type of child,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls,additional,HPSF,,java.lang.IndexOutOfBoundsException,Invalid position,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls,handle,HSSF,,java.lang.IllegalArgumentException,Had unexpected type of child,
@@ -303,13 +300,13 @@ spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-6137883240824832.xls,ha
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-6137883240824832.xls,handle,HPSF,,java.lang.IndexOutOfBoundsException,,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx,extract,"XSSF,OPC",,java.lang.IllegalStateException,Cannot get item at,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx,additional,XSSF,,java.lang.IllegalStateException,Cannot get item at,
-spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx,handle,XSSF,,java.lang.IllegalArgumentException,Could not read part,
+spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx,handle,"XSSF,OPC",,java.io.IOException,has more data than its declared size,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-4828727001088000.xlsx,extract,"XSSF,OPC",,org.apache.poi.openxml4j.exceptions.NotOfficeXmlFileException,No valid entries or contents found,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-4828727001088000.xlsx,additional,XSSF,,org.apache.poi.openxml4j.exceptions.NotOfficeXmlFileException,No valid entries or contents found,
spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-4828727001088000.xlsx,handle,XSSF,,org.apache.poi.ooxml.POIXMLException,error: Attribute name,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-6483562584932352.xls,handle,HPSF,,java.lang.IndexOutOfBoundsException,,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-6483562584932352.xls,additional,"HSSF,HPSF",,java.lang.IndexOutOfBoundsException,,
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx,handle,XWPF,,java.lang.IllegalStateException,Unable to write out settings,
+document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx,"handle,extract","XWPF,OPC",,java.io.IOException,has more data than its declared size,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5816431116615680.xls,"handle,additional",HPSF,,java.lang.ArrayIndexOutOfBoundsException,,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5816431116615680.xls,additional,HSSF,,org.apache.poi.util.RecordFormatException,Not enough data,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5816431116615680.xls,handle,HSSF,,java.lang.IllegalArgumentException,Sheet index,
@@ -320,16 +317,12 @@ spreadsheet/duplicate-filename.xlsx,"handle,extract","XSSF,OPC",,org.apache.poi.
spreadsheet/duplicate-filename.xlsx,additional,XSSF,,org.apache.poi.openxml4j.exceptions.InvalidOperationException,Can't open the specified file,
spreadsheet/duplicate-filename-case-insensitive.xlsx,"handle,extract","XSSF,OPC",,org.apache.poi.openxml4j.exceptions.InvalidFormatException,Input file contains more than 1 entry with the name,
spreadsheet/duplicate-filename-case-insensitive.xlsx,additional,XSSF,,org.apache.poi.openxml4j.exceptions.InvalidOperationException,Can't open the specified file,
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5166796835258368.docx,extract,"XWPF,OPC",,org.apache.poi.openxml4j.exceptions.InvalidFormatException,Input file contains more than 1 entry with the name,
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5166796835258368.docx,handle,XWPF,,org.apache.poi.openxml4j.opc.internal.InvalidZipException,Input file contains more than 1 entry with the name,
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5166796835258368.docx,handle,OPC,,org.apache.poi.openxml4j.exceptions.InvalidFormatException,Input file contains more than 1 entry with the name,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5026516754628608.vsdx,extract,"XDGF,OPC",,java.io.IOException,org.apache.poi.ooxml.POIXMLException: /visio/masters/masters.xml,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5026516754628608.vsdx,handle,XDGF,,org.apache.poi.ooxml.POIXMLException,/visio/masters/masters.xml,
+document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5166796835258368.docx,"handle,extract","XWPF,OPC",,java.io.IOException,has more data than its declared size,
+diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5026516754628608.vsdx,"handle,extract","XDGF,OPC",,java.io.IOException,has more data than its declared size,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4651309315719168.xls,extract,"HSSF,HPSF",,org.apache.poi.util.RecordFormatException,The content of an excel record cannot exceed 8224 bytes,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4651309315719168.xls,additional,HSSF,,java.lang.IllegalArgumentException,Name is too long,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4651309315719168.xls,handle,HSSF,,org.apache.poi.util.RecordFormatException,The content of an excel record cannot exceed 8224 bytes,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5492358185353216.vsdx,extract,"XDGF,OPC",,java.io.IOException,org.apache.poi.ooxml.POIXMLException: /visio/masters/masters.xml,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5492358185353216.vsdx,handle,XDGF,,org.apache.poi.ooxml.POIXMLException,/visio/masters/masters.xml,
+diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5492358185353216.vsdx,"handle,extract","XDGF,OPC",,java.io.IOException,has more data than its declared size,
document/clusterfuzz-testcase-POIHWPFFuzzer-5696094627495936.doc,additional,HPSF,,java.lang.IndexOutOfBoundsException,not found,
document/clusterfuzz-testcase-POIHWPFFuzzer-5696094627495936.doc,handle,"HWPF,HPSF",,java.lang.IndexOutOfBoundsException,not found,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6192650357112832.ppt,extract,"HSLF,HPSF",,org.apache.poi.hslf.exceptions.HSLFException,Couldn't instantiate the class for type with id,
@@ -343,19 +336,16 @@ slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6614960949821440.ppt,hand
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4657005060816896.xls,extract,"HSSF,HPSF",,java.lang.IndexOutOfBoundsException,Index,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4657005060816896.xls,"handle,additional",HPSF,,java.util.NoSuchElementException,Can't read past the end of the stream,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4657005060816896.xls,handle,HSSF,,java.lang.IllegalStateException,Did not have a ExtendedFormatRecord,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5313947071217664.vsdx,extract,"XDGF,OPC",,java.io.IOException,org.apache.poi.ooxml.POIXMLException: /visio/masters/masters.xml,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5313947071217664.vsdx,handle,XDGF,,org.apache.poi.ooxml.POIXMLException,/visio/masters/masters.xml,
+diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5313947071217664.vsdx,"handle,extract","XDGF,OPC",,java.io.IOException,has more data than its declared size,
poifs/MailSentPropertyMultiple.msg,extract,"HSMF,HPSF",,java.io.IOException,"Your InputStream was neither an OLE2 stream, nor an OOXML stream",
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-4838644450394112.pptx,extract,"XSLF,OPC",,java.lang.IllegalArgumentException,Could not retrieve Off from the XML object,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-4838644450394112.pptx,handle,XSLF,,java.lang.IllegalStateException,SlideMaster was not found,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-4986044400861184.pptx,handle,XSLF,,java.lang.IllegalArgumentException,No part found for relationship,
+slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-4838644450394112.pptx,"handle,extract","XSLF,OPC",,java.io.IOException,has more data than its declared size,
+slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-4986044400861184.pptx,"handle,extract","XSLF,OPC",,java.io.IOException,has more data than its declared size,
diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5842659694215168.vsdx,extract,"XDGF,OPC",,java.io.IOException,org.apache.poi.ooxml.POIXMLException: /visio/pages/pages.xml: /visio/pages/page1.xml,
diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-5842659694215168.vsdx,handle,XDGF,,org.apache.poi.ooxml.POIXMLException,/visio/pages/pages.xml: /visio/pages/page1.xml,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5195207308541952.doc,additional,HPSF,,java.lang.ArithmeticException,integer overflow,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5195207308541952.doc,handle,HWPF,,java.lang.IndexOutOfBoundsException,Block 111 not found,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5195207308541952.doc,handle,HPSF,,org.opentest4j.AssertionFailedError,expected: <true> but was: <false>,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-5611274456596480.pptx,extract,"XSLF,OPC",,java.lang.IllegalArgumentException,Could not retrieve Ext from the XML object,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-5611274456596480.pptx,handle,XSLF,,java.lang.IllegalArgumentException,Could not retrieve theme elements from shape,
+slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-5611274456596480.pptx,"handle,extract","XSLF,OPC",,java.io.IOException,has more data than its declared size,
diagram/clusterfuzz-testcase-minimized-POIHDGFFuzzer-6478389109981184.vsd,extract,"HDGF,HPSF",,java.lang.IllegalArgumentException,"Encountered too deep nesting, cannot process stream",
diagram/clusterfuzz-testcase-minimized-POIHDGFFuzzer-6478389109981184.vsd,handle,HDGF,,java.lang.IllegalArgumentException,"Encountered too deep nesting, cannot process stream",
spreadsheet/deep-data.xlsx,additional,XSSF,,org.apache.poi.openxml4j.exceptions.InvalidFormatException,Cannot create sheet-iterator with missing package part for workbook,
@@ -364,8 +354,7 @@ spreadsheet/deep-data.xlsx,handle,XSSF,,java.lang.IllegalArgumentException,Core-
slideshow/60f557c0a46bcb0068b1c3e15589dac383307bc8.ppt,handle,HSLF,,java.lang.IllegalStateException,Cannot read color scheme from sheet,
slideshow/6afff8111a22b118d1ed4eba5007c153de0b0ad7.ppt,handle,HSLF,,java.lang.IndexOutOfBoundsException,Index 0 out of bounds for length 0,
slideshow/2100a8d44da546f97ab7795c500a58bed6cb655d.ppt,handle,HSLF,,java.lang.IllegalStateException,Cannot read color scheme from sheet,
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-4961551840247808.docx,extract,"XWPF,OPC",,java.io.IOException,"Your InputStream was neither an OLE2 stream, nor an OOXML stream",
-document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-4961551840247808.docx,handle,OPC,,org.opentest4j.AssertionFailedError,"Expected one of XWPFRelation{application/vnd.ms-word.document.macroEnabled.main+xml//word/document.xml}, XWPFRelation{application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml//word/document.xml}, XWPFRelation{application/vnd.openxmlformats-officedocument.wordprocessingml.template.main+xml//word/document.xml}, but had application/xml ==> expe [...]
+document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-4961551840247808.docx,"handle,extract","XWPF,OPC",,java.io.IOException,has more data than its declared size,
slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6372932378820608.pptx,handle,XSLF,,java.lang.IllegalArgumentException,No part found for relationship id=rId8,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5832867957309440.doc,extract,"HWPF,HPSF",,java.lang.ArrayIndexOutOfBoundsException,,
document/clusterfuzz-testcase-minimized-POIHWPFFuzzer-5832867957309440.doc,handle,HWPF,,java.lang.ArrayIndexOutOfBoundsException,,
@@ -377,8 +366,7 @@ slideshow/61338.wmf,"handle,extract",HWMF,,org.apache.poi.util.RecordFormatExcep
slideshow/file-45.wmf,handle,HWMF,,org.apache.poi.util.RecordFormatException,The width or height specified in the header exceed the current limit,
spreadsheet/61294.emf,"handle,extract",HEMF,,org.apache.poi.util.RecordFormatException,java.lang.IllegalStateException: Unexpected end-of-file,
publisher/clusterfuzz-testcase-minimized-POIHPBFFuzzer-6325615354773504.pub,"handle,extract",HPBF,,java.lang.IllegalArgumentException,File invalid - failed to find document entry,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6071540680032256.pptx,extract,"XSLF,OPC",,java.lang.IllegalStateException,"Invalid content in diagram, cannot extract text",
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6071540680032256.pptx,handle,XSLF,,java.lang.IllegalStateException,SlideMaster was not found for Name,
+slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6071540680032256.pptx,"handle,extract","XSLF,OPC",,java.io.IOException,has more data than its declared size,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4734163573080064.xls,extract,"HSSF,HPSF",,java.lang.IndexOutOfBoundsException,Index 0 out of bounds for length 0,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4734163573080064.xls,additional,"HSSF,HPSF",,java.lang.IndexOutOfBoundsException,Block 13 not found,
spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-4734163573080064.xls,handle,HSSF,,org.apache.poi.util.RecordFormatException,Tried to allocate an array of length,
@@ -388,8 +376,7 @@ slideshow/crash-7b60e9fe792eaaf1bba8be90c2b62f057cfff142.emf,"handle,extract",HE
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt,additional,HPSF,,org.apache.poi.util.RecordFormatException,Tried to allocate an array of length,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt,handle,HSLF,,org.apache.poi.util.RecordFormatException,Tried to allocate an array of length,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt,handle,HPSF,,org.opentest4j.AssertionFailedError,expected: <true> but was: <false>,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6312416206454784.vsdx,"handle,extract",XDGF,,java.io.IOException,Truncated ZIP file,
-diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6312416206454784.vsdx,"handle,extract",OPC,,java.io.IOException,Truncated ZIP file,
+diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6312416206454784.vsdx,"handle,extract","XDGF,OPC",,java.io.IOException,has more data than its declared size,
slideshow/62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt,extract,"HSLF,HPSF",,org.apache.poi.util.RecordFormatException,Could not read EscherSpRecord as child of SpContainer,
slideshow/62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt,handle,HSLF,,java.lang.IllegalStateException,Cannot get anchor,
spreadsheet/cf9f845e73447b092477d0472402a5baea4b8c9f.xls,handle,HSSF,,java.lang.IllegalStateException,Cannot serialize EscherAggregate with missing shape-object,
@@ -400,8 +387,7 @@ slideshow/cf5f6fde99a8b3ea5a4946c258b7abad6f30b0c5.ppt,handle,HPSF,,org.opentest
slideshow/clusterfuzz-testcase-minimized-6701721724125184.wmf,"handle,extract",HWMF,,java.lang.IllegalArgumentException,Could not read brush-style,
spreadsheet/LIBRE_OFFICE-94379-0.zip-57.xls,handle,HSSF,,java.lang.IllegalStateException,Did not have an ObjRecord for the HSSFShapeGroup,
slideshow/VHZ2NYFUYUUJNGLABL26ORTQZA76FJEW.emf,handle,HEMF,,org.apache.poi.util.RecordFormatException,Could not convert object of type class,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6435650376957952.pptx,handle,XSLF,,org.apache.xmlbeans.XmlException,error: The document is not a,
-slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6435650376957952.pptx,extract,"XSLF,OPC",,java.lang.IllegalStateException,org.apache.poi.ooxml.POIXMLException,
+slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6435650376957952.pptx,"handle,extract","XSLF,OPC",,java.io.IOException,has more data than its declared size,
slideshow/clusterfuzz-testcase-minimized-POIFileHandlerFuzzer-6466833057382400.emf,"handle,extract",HEMF,,org.apache.poi.util.RecordFormatException,java.lang.IllegalStateException: Unexpected end-of-file,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-4983252485210112.ppt,"handle,additional",HPSF,,java.lang.IndexOutOfBoundsException,Block 21 not found,
slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-4983252485210112.ppt,handle,HSLF,,org.apache.poi.util.RecordFormatException,Tried to allocate an array,
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org