pjfanning opened a new pull request, #1304: URL: https://github.com/apache/poi/pull/1304
Fixes https://bz.apache.org/bugzilla/show_bug.cgi?id=66245 (reported from TIKA-3841). `ArrayIndexOutOfBoundsException: Index 351 out of bounds for length 351` at `SprmOperation.initSize`: the grpprl ended with a 2-byte opcode whose size code is 6 (variable length), so there was no room for the operand-length byte(s). `SprmIterator.hasNext()` only requires 2 bytes, so the `SprmOperation` was constructed and `initSize` read past the array. ### Changes - `SprmOperation.initSize`, size code 6: if the length byte(s) lie beyond the end of the grpprl, log a warning and treat the remaining bytes as the SPRM's size. The iterator then stops there. Covers both the 1-byte length and the 2-byte length (`sprmPChgTabs` 0xC615 / `sprmTDefTable` 0xD608) variants. - `SprmOperation.getOperand`, size code 6: no read past the grpprl or past the 4-byte `codeBytes` array (the bounds check was off by one against the index actually read, and the operand length byte was used unchecked). - `SectionSprmUncompressor.uncompressSEP`: log and skip an unapplyable SPRM, as the PAP/CHP/TAP uncompressors already do, so a truncated operand in a SEPX no longer aborts the whole section. - `TableSprmUncompressor.uncompressTAP`: `sprmTDefTable` with no operand bytes falls back to the existing one-column default instead of throwing. The sample document was deleted from Bugzilla at the reporter's request, so the new `TestSprmOperation` uses synthetic grpprls. All five tests fail with `ArrayIndexOutOfBoundsException` without the main-code changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
