From 1b88529d072a9d4462c445a9953b898cb37c6913 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Tue, 22 Aug 2023 14:22:06 +0000 Subject: [PATCH] Bug 66425: Avoid a NullPointerException found via oss-fuzz We try to avoid throwing NullPointerException, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61644 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1911842 13f79535-47bb-0310-9956-ffa450edef68 --- .../usermodel/XWPFAbstractFootnotesEndnotes.java | 4 +++- ...minimized-POIXWPFFuzzer-5569740188549120.docx | Bin 0 -> 6043 bytes 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5569740188549120.docx diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFAbstractFootnotesEndnotes.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFAbstractFootnotesEndnotes.java index d626350298..c6bca6d5ad 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFAbstractFootnotesEndnotes.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFAbstractFootnotesEndnotes.java @@ -57,8 +57,10 @@ public abstract class XWPFAbstractFootnotesEndnotes extends POIXMLDocumentPart { public XWPFAbstractFootnoteEndnote getFootnoteById(int id) { for (XWPFAbstractFootnoteEndnote note : listFootnote) { - if (note.getCTFtnEdn().getId().intValue() == id) + if (note.getCTFtnEdn().getId() != null && + note.getCTFtnEdn().getId().intValue() == id) { return note; + } } return null; } diff --git a/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5569740188549120.docx b/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5569740188549120.docx new file mode 100644 index 0000000000000000000000000000000000000000..6947f6fbec512e02f94bd258e44fa018b3538269 GIT binary patch literal 6043 zcmeHLS2!H(wjNz{Li93v?<7Hn;MYct-lCT=7@g4~x=v z%nwY8g(Y~huXv3*wwk0N)Tgo85a?}dN-Z&~#2;Xxmt-4ne3ye9M4Qf!Dvacm=oL6d zhmhPXKOLPj48D6G2scpRBoin#(&SO_$+?Sxp3rI-+^byK40)YF{tn8cGxnK}-zN04 z#b!n;Yw(Efo75X^-9+lH)pt`OWY~1tU1X?<`-J_|a{J|?Pk6_I)#R$X~X1>)n(1Ls;0HUX~wMCsTt(*9Fy-H z-zLLu-xVrSs@hP}nejq`SB1|vE~~sTU|vC3nP4+*f$QZ5r!F2iH_0fM_^OyCu8ffE z!FltgT(_rp_~RbpM)a8rS&T1f{|Wpo?o&pq0CY+D{_*aL<(O}I5wZWrXpWY4hLLO7 z9tdcD<28IMY|~toxye|PveRyVg#!TG-eLi?{}-8=lIZFW?+~ha$5p~RGFy1qIeQ8T z{*M14@n4v^|8n)XyG>dog2&f!B9y97y$SfzAz74p??s?7G~q^a;JU2Mem=a!MIbtyXwF8DNh~I>=GsmN2|0btVz2+ z%VW_iq7I+pql_urat>D9j^7qYtnbTLQ$czNfp(2@&TE@boUY$BuVIx#C-BpXXu+Sk z`Au~RPnv?7njB)-AZoKnj1F8kXLGaXKY5ajsDD^^`$VOhz+=ojRTHyQi7;HhS{Jjqx$sz)9vvRf4Ar-Qj29 zi$m?FBKMWaf{(5#m+#>5??^kXCAWKhhce##008-2#ov+kuNd1l8ggBbq+F!_DQo74 zDx?`>t6((TQ@5N_G5HL^`xI7z)}D%{MNq0Zr4Cdq>mFe>jU^mu`Ex^heNc2tHLCOh zR*B@lsZ!)f)D0k^C~@lN|e{-S}mW$BlF_s&0a+PK7Lank=vp|1JZ zE(Mt!Ml_{zlCi{T&14A37f(*~$I7Q|M}11hO=c+YJ?)xKNm1L zhfVCo^gOT)T2?Lxx0=uBkvlNZnxXDe2CW};)tohVR4PbU9=6o{rn}lbv+8m zx&ZRzQym!Gw#@gv8o7~15nHwB_?~dfo4>&K5(yI$aQ+lChRCFB%P?0@**{zNJ6NP4 znI#>u`k8<`W;Cq9thm_%M9 z=Jh2ta$Jldv9~2=Ubw-H)SnAZaww|(kF>QlW7Kob`;o!goMlLWZ7%S7d+HhOw7;06 z;jZ3zB^T$%w8%{Po^3^ab$uQ0y3u0HEqv1}93!Q0dlSBonArHAA_%L?YZ)dV^Qsw2 z=Udh$vWi-*)C&~Fx{)}V%iP<-k{Ts(;}TFXQKTy-1z%wNrsu2RcwFu@2^w+b+N$NmDrm{|hmfY4 z)GS7ZoSf_2w;g^16O}0|o5t}(6!TBdNnR^p*Pc`EX*Sky2#}?_Dm2P(;iDBjX`ve8 z5l#v<&sTg_K2SC{JpLFV?pqU>V0W0E(4BUU;osK%o*q13+TIdKss(k62+v_mf2?7$ za{cpcr2!oB^+2M}GqmS*pRLE9i&-dxF5uT$W!+Y1q^0|Hb@o@$zO}V;zsXLZhUx-9 zh8d+)s_GdV2*36;jyn0#Agy7vQ&kLWL8VC&qIx%9>(biSih5Lph9u%C?{GdcFN*tw z+TCRn{?xjbdHtsoC1S)Q^Y`Z0dzbz19%koi>k9L-^Zc!o!+Jxm^TK2;cRdWhWj;BZ z(+vmQ*zlO%2kUH5tt^Avf`zB#=2DPHCkDkr=D+y|?x{#~7p>>znetvCmd%@F9Ag2o zEWF0FYwH{O`_1b zcatn4v)pXOT?KGe9Eo<**5cIhsVa*&F<;dg;}bb08vVrS{=je}d;?lLeN-U0A~RB7 z_@Lv%oF)jAu>q)EiByX=8>+1kyasmB%^rk`mSWnDYD4<_zC^f zliq~dOas3c-!$p*99e6Fb3HfUuhSJ}&ET96q2-ITuf-~)PXwM401`KCP*>^SM9pifOc=ill zt8jl8BvG$0uufb5hxNf|LE5bjMyc)xp)r`Aw$>~n^DE=vV_Ar>&|KLS;$hGqh zFNT}4ifv(7LD5R#&$)k;CXl)@78%vGrtKsioSJjFU&!MhPZ1_L_&WIbq_6KZ8_a4x z66#2`l^jv!B#KhYoJp3Eb>SpTKL4!VLrJ5P+`6~s;~o6TIhKxv2EWsx-zu=GYflo} zRD1K>z;UCr_p`6BeKCHlBua&ia}tKx*s|DmpHwO6P!hX`RpEyMiRC zDhz2#Gb75?Th*M{;hXtPFQERDvgAHN0031#dC~p;b};fmeT=Q|aJObz>dc((6mOr2 zS+qgWyg- z5NwC43lDW;)9}_mIEDB<`9s+72TIxD=??o5eI`#>5-s>E&<_knkYUsL_VEPmY^UUN zYc+2JSsHzHzL@s9hZv1+vg{%D&gSI@9BqRigP7lel|k^aq`7T{=$`Q1 zhu5+sb12JDaSh+#gcvsC>}zlto+-$lo-4_I#gO?=N0+=7n%=rQM<|RQK=u0@0l$Z2 zFGo8UyMIKH-_+kW9&@GtgQlHrpQNC*zUsboe8D6A?Qg`jkb-Xlo9-=4Xic%^noL@* z;}2>HDlCdm8H%yZ9 zgmux10OYfQgN3XkE83x08K6iDy&Jg|P6BJj7GVosAe-bv3toZIKQelm5boH{eamq# z=wxY`^XS7cj$`UG_hBMr6nrJrft*sA(gV?L!JlM7G_s7cOw2OPc+0t+Kl&m+wd+n( zda%D$&odw1WQyKBY!z%Qlj*M1+sog5J)HZnzDYDHU6=L!E9A&T-H3%+I>nLiM!Y)t z5vTmnj@r)TMR+@gutY4h&Sb;@-Z=)SM2D>#q|1z{1(YoG`)$abZ1JP*OH4`|&KPbZ zXtSa5N(Clh?<#fT{@@S8E9q*nuj}A=Fu4a7*&T*-(2l(t>$^R>|!311qN_6CL zzeOp+z87xsK0!ZjL_V=X|!{;DeN+2{6m@_0c( z;l^}~$_cpcPyE1g(ma^YX_wq7cf+lV9bc}MS*-ycK6W4$BxrTh9~x|Il#UCtUbW8X zbFpbLWp9qL;cEL}g&8CP2KVjRt1x`6r+Gz1qM}YYi9RC%;!H2TpW5HzJjO{6%o}$> z&}BSmDg*~;N@~PNI%2!iQq2ng83=^cHDK;AR37B{psH(QV zN3Sym6PH!042-Ir!Og(D(Oz;i${#>U)zKS~fB?^@?FeKT)&JYt6LJDocOF#xvB^#( zA{2qikYVCjO4ZBjCSDgcP8l)W(>#!%=1AR}r6teD>*ghyR;@JMEOFW((Yp(Udc0H_ zDIL7zNz4?u*bU{J$Sd9=;%%&{=9|hRMnpSt6+i2>XEgz+(qL2AWSmydNeScNt%;-Lf8i|B+sLe))>-*?iI}N_5 z2_D%i9Y55z$=0f8&-4ZrCTg|E);mPr1i7j>zoVcDjOIKOCy*&MWfjRKixJs(93Wz5 zwU%CfwbH6syzl4TD!a(ew(c#3xVV&6?7m#kV#oSpB1E=&f?|)|gf+nqwE<4=pp^n*5@Vr*uV2G^V=g}y7LEYygj{OE=DfS|78+DyzE^5 L-v0g%9D=_A4)LJ0 literal 0 HcmV?d00001