jmestwa-coder opened a new pull request, #1080: URL: https://github.com/apache/poi/pull/1080
Found while fuzzing Ole10Native record parsing. readUtf16 reads a 32-bit char count and hands size * 2 to IOUtils.toByteArray; a count near 0x40000000 makes that product overflow to a negative int, which slips past the MAX_STRING_LENGTH cap so an oversized record surfaces a raw IllegalArgumentException from getFromUnicodeLE rather than the RecordFormatException the cap is meant to raise. Compute the byte count as size * 2L so the long overload applies the cap before narrowing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
