Created attachment 28072 [details]
test document that causes the error.

On certain office documents (attached is one where this happens) running the following code causes the array 'headings' truncated. So the last field (headParts) of the last VtHeadingPair is 5 or 6 bytes long instead of 8. (depending on the document)

---------------

PropertySet ps = PropertySetFactory.create(inStream);
 (!(ps instanceof DocumentSummaryInformation))
     return;
DocumentSummaryInformation dsi = (DocumentSummaryInformation) ps;
Section s = (Section) dsi.getSections().get(0);
Object hdrs = s.getProperty(PropertyIDMap.PID_HEADINGPAIR); 
byte[] headings = null;
if (hdrs == null)
     return;
headings = (byte[]) hdrs;

----------------

It happens with excel and word documents, but seemingly not with powerpoint ones. 

This problem occurs using POI 3.8 beta 6 (r1213215 from SVN, I think). It does not occur in 3.6+dfsg-2 from debian sid.

I've had a look through the Document, the relevant part (with my annotations) is: 

------------...
0000f8c0  fe ff 00 00 05 01 02 00  00 00 00 00 00 00 00 00  |................|
	 |order|vers |	sysid    |     clsid...
0000f8d0  00 00 00 00 00 00 00 00  02 00 00 00 02 d5 cd d5  |................|
		clsid...	  |#propsets=2|  fmtid 0      
0000f8e0  9c 2e 1b 10 93 97 08 00  2b 2c f9 ae 44 00 00 00  |........+,..D...|
		fmtid 0                       | offset0=68
0000f8f0  05 d5 cd d5 9c 2e 1b 10  93 97 08 00 2b 2c f9 ae  |............+,..|
				...fmtid 1...
0000f900  58 01 00 00 14 01 00 00  0c 00 00 00 01 00 00 00  |X...............| 
          offset1=344| PROPSET 0 Starts here...
0000f910  68 00 00 00 0f 00 00 00  70 00 00 00 05 00 00 00  |h.......p.......|
... etc ...
0000f9f0  61 20 74 65 73 74 00 0c  10 00 00 02 00 00 00 1e  |a test..........|
                              | type | pad |  count=1  |type=string 
0000fa00  00 00 00 06 00 00 00 54  69 74 6c 65 00 03 00 00  |.......Title....|
		  | length=6  |  string...       |type=int32
0000fa10  00 01 00 00 00 00 00 00  a8 00 00 00 03 00 00 00  |................|
	    |headparts=1|	  |-- PROPSET1 starts here
---------------

So the document seems well formed. 

I had a hunt around the POI source, but couldn't see anything obviously wrong. 

Using sun java 6 (1.6.0) 64 bit.