Bug 57080 - IndexOutOfBoundsException in poi decryptor
Summary: IndexOutOfBoundsException in poi decryptor
Status: RESOLVED FIXED
Alias: None
Product: POI
Classification: Unclassified
Component: POIFS (show other bugs)
Version: 3.10-FINAL
Hardware: PC All
: P2 normal (vote)
Target Milestone: ---
Assignee: POI Developers List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-13 18:38 UTC by PJ Fanning
Modified: 2014-10-14 18:22 UTC (History)
0 users


Attachments
xlsx file that causes issue (password=pwd123) (10.00 KB, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet)
2014-10-13 19:55 UTC, PJ Fanning 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description PJ Fanning 2014-10-13 18:38:52 UTC 
Hi,
I will add a zip file containing a test case and the xlsx file.
The password protected xlsx was generated using the extenxls jar and I suspect that it creates metadata that is not 100% valid.
If I resave the xlsx using Excel 2011, the file can be decrypted ok with poi (v3.10.1).
Would it be possible for someone to look at why the IndexOutOfBoundsException is happening and if the code could workaround from the underlying xlsx issue?

Regards,
PJ

java.lang.ArrayIndexOutOfBoundsException: 12
	at org.apache.poi.poifs.storage.DocumentBlock.getDataInputBlock(DocumentBlock.java:177)
	at org.apache.poi.poifs.filesystem.POIFSDocument.getDataInputBlock(POIFSDocument.java:284)
	at org.apache.poi.poifs.filesystem.ODocumentInputStream.getDataInputBlock(ODocumentInputStream.java:107)
	at org.apache.poi.poifs.filesystem.ODocumentInputStream.readFully(ODocumentInputStream.java:245)
	at org.apache.poi.poifs.filesystem.ODocumentInputStream.read(ODocumentInputStream.java:140)
	at org.apache.poi.poifs.filesystem.DocumentInputStream.read(DocumentInputStream.java:118)
	at org.apache.poi.poifs.filesystem.DocumentInputStream.read(DocumentInputStream.java:114)
	at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:103)
	at javax.crypto.CipherInputStream.read(CipherInputStream.java:224)
	at org.apache.poi.util.BoundedInputStream.read(BoundedInputStream.java:121)
	at org.apache.poi.util.BoundedInputStream.read(BoundedInputStream.java:103)
	at org.apache.poi.util.IOUtils.toByteArray(IOUtils.java:48)
	at test.PoiTest.decrypt(PoiTest.java:22)
Comment 1 Andreas Beeker 2014-10-13 19:49:04 UTC 
> I will add a zip file containing a test case and the xlsx file.

the xlsx and its password is enough. I'll have a look onto it.
Comment 2 PJ Fanning 2014-10-13 19:55:55 UTC 
Created attachment 32103 [details]
xlsx file that causes issue (password=pwd123)
Comment 3 PJ Fanning 2014-10-13 19:57:25 UTC 
Thanks Andreas.
Attached xlsx file, password=pwd123.
Comment 4 Nick Burch 2014-10-13 20:52:51 UTC 
Can you try it with NPOIFSFileSystem rather than POIFSFileSystem?
Comment 5 PJ Fanning 2014-10-13 20:57:45 UTC 
With NPOIFSFileSystem, I get:
java.lang.IndexOutOfBoundsException: Can't read past the end of the stream
	at org.apache.poi.poifs.filesystem.NPOIFSStream$StreamBlockByteBufferIterator.next(NPOIFSStream.java:164)
	at org.apache.poi.poifs.filesystem.NPOIFSStream$StreamBlockByteBufferIterator.next(NPOIFSStream.java:142)
	at org.apache.poi.poifs.filesystem.NDocumentInputStream.readFully(NDocumentInputStream.java:248)
	at org.apache.poi.poifs.filesystem.NDocumentInputStream.read(NDocumentInputStream.java:150)
	at org.apache.poi.poifs.filesystem.DocumentInputStream.read(DocumentInputStream.java:118)
	at org.apache.poi.poifs.filesystem.DocumentInputStream.read(DocumentInputStream.java:114)
	at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:103)
	at javax.crypto.CipherInputStream.read(CipherInputStream.java:224)
	at org.apache.poi.util.BoundedInputStream.read(BoundedInputStream.java:121)
	at org.apache.poi.util.BoundedInputStream.read(BoundedInputStream.java:103)
	at org.apache.poi.util.IOUtils.toByteArray(IOUtils.java:48)
	at test.PoiTest.decrypt(PoiTest.java:22)
Comment 6 Andreas Beeker 2014-10-13 23:45:17 UTC 
Fixed with r1631600
The ole entry size was to big, so I've limited it based on the encrypted size rounded to the next block size.
Comment 7 PJ Fanning 2014-10-14 18:22:37 UTC 
Thanks for the quick response. I have verified that the latest source fixes this for both POIFSFileSystem and NPOIFSFileSystem.