pjfanning opened a new pull request, #1227:
URL: https://github.com/apache/poi/pull/1227
### Problem
`ZipArchiveFakeEntry` (used when opening OPC packages — xlsx/docx/pptx —
from an `InputStream`) sized its in-memory read buffer from
`ZipArchiveEntry.getSize()`. That value comes from the zip **local file
header**, which is attacker-controlled. A tiny entry (a few hundred bytes) can
declare an uncompressed size of e.g. `99_999_999`, and the old code would
eagerly allocate up to `getMaxEntrySize()` (100 MB by default) before reading a
single byte:
```java
data = (entrySize == -1) ? IOUtils.toByteArrayWithMaxLength(inp,
getMaxEntrySize()) :
IOUtils.toByteArray(inp, entrySize, getMaxEntrySize(),
"ZipArchiveFakeEntry.setMaxEntrySize()");
```
`IOUtils.toByteArray(..., length, maxLength, ...)` uses the known `length`
to pre-size the backing `UnsynchronizedByteArrayOutputStream`, so ~100 MB is
committed up front. The `MIN_INFLATE_RATIO` guard never fires because almost
nothing is actually inflated — the allocation is driven purely by the
unverified header field (~10^6 amplification, enough to OOM a modest-heap
server-side converter with a tiny, repeatable payload).
### Fix
Read the actual bytes present via `IOUtils.toByteArrayWithMaxLength(inp,
getMaxEntrySize())` — the initial buffer stays small (4 KB) and grows only as
real data arrives, bounded by `getMaxEntrySize()` (a stream longer than that
fails with `RecordFormatException`). This is exactly how the existing
unknown-size (`entrySize == -1`) branch already behaves.
### Behaviour change
An entry whose declared size exceeds its actual byte count previously threw
`EOFException`; it now reads the actual bytes (matching the `entrySize == -1`
path and typical zip readers). The regression test that pinned the old
behaviour (its comment invited this change) is updated, and a test covering the
max-entry-size rejection is added.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
