From 8df560eed2dc223e140ac9e649a4523aab60248b Mon Sep 17 00:00:00 2001
From: PJ Fanning <pjfanning@users.noreply.github.com>
Date: Sun, 3 Aug 2025 14:47:10 +0100
Subject: [PATCH] don't return inner bytes

---
 poi/src/main/java/org/apache/poi/hpsf/ClassID.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/poi/src/main/java/org/apache/poi/hpsf/ClassID.java b/poi/src/main/java/org/apache/poi/hpsf/ClassID.java
index 7e0ec5e2d8..7c99b1c4c3 100644
--- a/poi/src/main/java/org/apache/poi/hpsf/ClassID.java
+++ b/poi/src/main/java/org/apache/poi/hpsf/ClassID.java
@@ -109,11 +109,12 @@ public class ClassID implements Duplicatable, GenericRecord {
 
     /**
      * Gets the bytes making out the class ID. They are returned in correct order, i.e. big-endian.
+     * This no longer returns a reference to the internal byte array, but a copy of it.
      *
      * @return the bytes making out the class ID.
      */
     public byte[] getBytes() {
-        return bytes;
+        return bytes.clone();
     }
 
     /**