[bug-65899] fix issue where malformed tnef file can cause memory prob…

…lems git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1898208 13f79535-47bb-0310-9956-ffa450edef68
apache · Feb 19, 2022 · 6622d9b · 6622d9b
1 parent c1b0736
commit 6622d9b
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 3 deletions.
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hmef/attribute/MAPIAttribute.java b/poi-scratchpad/src/main/java/org/apache/poi/hmef/attribute/MAPIAttribute.java
@@ -150,7 +150,9 @@ else if(parent.getProperty() == TNEFProperty.ID_ATTACHMENT) {
          MAPIProperty prop = MAPIProperty.get(id);
          if(id >= 0x8000 && id <= 0xFFFF) {
             byte[] guid = new byte[16];
-            IOUtils.readFully(inp, guid);
+            if (IOUtils.readFully(inp, guid) < 0) {
+               throw new IOException("Not enough data to read guid");
+            }
             int mptype = LittleEndian.readInt(inp);
 
             // Get the name of it
@@ -164,7 +166,9 @@ else if(parent.getProperty() == TNEFProperty.ID_ATTACHMENT) {
                // Custom name was stored
                int mplen = LittleEndian.readInt(inp);
                byte[] mpdata = IOUtils.safelyAllocate(mplen, MAX_RECORD_LENGTH);
-               IOUtils.readFully(inp, mpdata);
+               if (IOUtils.readFully(inp, mpdata) < 0) {
+                  throw new IOException("Not enough data to read " + mplen + " bytes for attribute name");
+               }
                name = StringUtil.getFromUnicodeLE(mpdata, 0, (mplen/2)-1);
                skipToBoundary(mplen, inp);
             }
@@ -189,7 +193,9 @@ else if(parent.getProperty() == TNEFProperty.ID_ATTACHMENT) {
          for(int j=0; j<values; j++) {
             int len = getLength(type, inp);
             byte[] data = IOUtils.safelyAllocate(len, MAX_RECORD_LENGTH);
-            IOUtils.readFully(inp, data);
+            if (IOUtils.readFully(inp, data) < 0) {
+               throw new IOException("Not enough data to read " + len + " bytes of attribute value");
+            }
             skipToBoundary(len, inp);
 
             // Create

diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hmef/attribute/TestTNEFAttributes.java b/poi-scratchpad/src/test/java/org/apache/poi/hmef/attribute/TestTNEFAttributes.java
@@ -19,8 +19,10 @@ Licensed to the Apache Software Foundation (ASF) under one or more
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.text.DateFormat;
@@ -47,6 +49,17 @@ void setUp() throws Exception {
         }
     }
 
+    /**
+     * Test malformed TNEF is detected by MAPIAttribute and does not cause Out Of Memory error
+     */
+    @Test
+    void testMalformedTNEF() throws Exception {
+        try (InputStream is = _samples.openResourceAsStream("oom.tnef")) {
+            quick = new HMEFMessage(is);
+        } catch (Exception e) {
+            assertTrue(e instanceof IOException);
+        }
+    }
     /**
      * Test counts
      */

diff --git a/test-data/hmef/oom.tnef b/test-data/hmef/oom.tnef