Re: [PR] reject negative UTF length in LongUTFDataInputStrea m.readLongUTF [poi-xmlbeans]

aizu-m commented on PR #93:
URL: https://github.com/apache/poi-xmlbeans/pull/93#issuecomment-5353767705

   Fair point, it's an internal class and the only realistic trigger is a corrupt or tampered .xsb on the classpath. I hit it while fuzzing the string pool loader, same path as #88 and #89. Cost-wise it's one int compare per pooled string at schema load, nothing on the parse or save paths, so I don't think it's measurable, but I take the point that each of these adds up. If you'd rather not carry it, I'm fine with this being closed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]