pjfanning opened a new pull request, #1232:
URL: https://github.com/apache/poi/pull/1232
Correctness fix spotted during a review of the HSSF/BIFF8 decryption path.
`Biff8DecryptingStream.readFully(byte[] buf, int off, int len)` passes
`buf.length` instead of `len` to `readPlain` on the never-encrypted-record
branch:
```java
public void readFully(byte[] buf, int off, int len) {
if (shouldSkipEncryptionOnCurrentRecord) {
readPlain(buf, off, buf.length); // should be len
} else {
ccis.readFully(buf, off, len);
}
}
```
For a never-encrypted record (BOF / InterfaceHdr / FilePass):
- with `off > 0`, `readPlain(buf, off, buf.length)` writes past `off + len`
and runs off the end of the array (`ArrayIndexOutOfBoundsException`);
- with `off == 0` and `len < buf.length`, it reads `buf.length` bytes from
the stream instead of `len`, over-reading and misaligning subsequent reads.
The encrypted branch already uses `len` correctly. This passes `len` on both
paths.
Not a security issue — it only affects the small set of never-encrypted
record types and at worst throws a Java exception. Added two regression tests
(offset > 0, and len < buf.length) which fail before the change and pass after;
the existing `TestBiff8DecryptingStream` cases are unaffected.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
