pashko/apache-poi
1
0
Fork 0
mirror of https://github.com/apache/poi.git synced 2026-02-27 20:40:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Perform an allocation-check for .emf files

Browse Source
This commit is contained in:
Dominik Stadler 2026-01-20 21:49:20 +01:00
parent 5eba199642
commit 0ae15edb2c
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfDraw.java
View File

@ -39,10 +39,14 @@ import org.apache.poi.hwmf.record.HwmfDraw;
import org.apache.poi.hwmf.record.HwmfDraw.WmfSelectObject; import org.apache.poi.hwmf.record.HwmfDraw.WmfSelectObject;
import org.apache.poi.util.GenericRecordJsonWriter; import org.apache.poi.util.GenericRecordJsonWriter;
import org.apache.poi.util.GenericRecordUtil; import org.apache.poi.util.GenericRecordUtil;
import org.apache.poi.util.IOUtils;
import org.apache.poi.util.LittleEndianConsts; import org.apache.poi.util.LittleEndianConsts;
import org.apache.poi.util.LittleEndianInputStream; import org.apache.poi.util.LittleEndianInputStream;
public final class HemfDraw { public final class HemfDraw {
// arbitrary limit to avoid OOM on malformed files. This may need increasing if "normal" files have more than this
public static final int MAX_NUMBER_OF_POLYGONS = 100_000;
private HemfDraw() {} private HemfDraw() {}
/** /**
@ -501,6 +505,7 @@ public final class HemfDraw {
size += 2 * LittleEndianConsts.INT_SIZE; size += 2 * LittleEndianConsts.INT_SIZE;
// An array of 32-bit unsigned integers that specifies the point count for each polygon. // An array of 32-bit unsigned integers that specifies the point count for each polygon.
IOUtils.safelyAllocateCheck(numberOfPolygons, MAX_NUMBER_OF_POLYGONS);
long[] polygonPointCount = new long[(int)numberOfPolygons]; long[] polygonPointCount = new long[(int)numberOfPolygons];
size += numberOfPolygons * LittleEndianConsts.INT_SIZE; size += numberOfPolygons * LittleEndianConsts.INT_SIZE;