https://issues.apache.org/bugzilla/show_bug.cgi?id=50539

           Summary: Error reading in a vml file with unmatched <br>
           Product: POI
           Version: 3.7
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: normal
          Priority: P2
         Component: XSSF
        AssignedTo: [email protected]
        ReportedBy: [email protected]


Created an attachment (id=26454)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=26454)
VML file illustrating the problem

In the EvilUnclosedBRFixingInputStream.java file, it does not properly handle a
case where there is a <br> in the overflow part of the buffer. It throws a
NegativeArraySizeException.

The fixup function needs to not process <br> tags past the end of the shortened
buffer, and when returning the spare bytes it needs to run fixup.

You can process the attached VML file through the
EvilUnclosedBRFixingInputStream to reproduce the exception.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to