From 2c5264277a879b4adba6593b79053fbb8ae4df29 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Mon, 7 Aug 2023 14:32:11 +0000 Subject: [PATCH] Bug 66425: Avoid an AssertionError found via oss-fuzz We try to avoid throwing AssertionError to be triggered by input data, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61251 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1911514 13f79535-47bb-0310-9956-ffa450edef68 --- .../apache/poi/stress/HSLFFileHandler.java | 2 ++ .../poi/hslf/record/EscherPlaceholder.java | 9 ++++++++- .../apache/poi/hslf/usermodel/HSLFShape.java | 4 ++++ ...nimized-POIHSLFFuzzer-4630915954114560.ppt | Bin 0 -> 12800 bytes test-data/spreadsheet/stress.xls | Bin 59392 -> 59904 bytes 5 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-4630915954114560.ppt diff --git a/poi-integration/src/test/java/org/apache/poi/stress/HSLFFileHandler.java b/poi-integration/src/test/java/org/apache/poi/stress/HSLFFileHandler.java index d496d0b85a..f25da02fa8 100644 --- a/poi-integration/src/test/java/org/apache/poi/stress/HSLFFileHandler.java +++ b/poi-integration/src/test/java/org/apache/poi/stress/HSLFFileHandler.java @@ -84,6 +84,8 @@ public class HSLFFileHandler extends SlideShowHandler { } handleExtracting(file); + + handleAdditional(file); } public static void main(String[] args) throws Exception { diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/EscherPlaceholder.java b/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/EscherPlaceholder.java index 28dff25ce9..f474f2171c 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/EscherPlaceholder.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/EscherPlaceholder.java @@ -20,6 +20,8 @@ package org.apache.poi.hslf.record; import java.util.Map; import java.util.function.Supplier; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; import org.apache.poi.ddf.EscherRecord; import org.apache.poi.ddf.EscherRecordFactory; import org.apache.poi.ddf.EscherSerializationListener; @@ -32,6 +34,8 @@ import org.apache.poi.util.LittleEndian; * the slide layout as specified in the SlideAtom record. */ public class EscherPlaceholder extends EscherRecord { + private static final Logger LOG = LogManager.getLogger(EscherPlaceholder.class); + public static final short RECORD_ID = RecordTypes.OEPlaceholderAtom.typeID; public static final String RECORD_DESCRIPTION = "msofbtClientTextboxPlaceholder"; @@ -59,7 +63,10 @@ public class EscherPlaceholder extends EscherRecord { size = data[offset+13]; unused = LittleEndian.getShort(data, offset+14); - assert(bytesRemaining + 8 == 16); + if (bytesRemaining + 8 != 16) { + LOG.warn("Invalid header-data received, should have 8 bytes left, but had: " + bytesRemaining); + } + return bytesRemaining + 8; } diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFShape.java b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFShape.java index 8dd66e94fe..007259230f 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFShape.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFShape.java @@ -247,6 +247,10 @@ public abstract class HSLFShape implements Shape { } public T getEscherChild(int recordId){ + if (_escherContainer == null) { + throw new IllegalStateException("Did not have a container for fetching children"); + } + return _escherContainer.getChildById((short)recordId); } diff --git a/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-4630915954114560.ppt b/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-4630915954114560.ppt new file mode 100644 index 0000000000000000000000000000000000000000..c70d8259a82d6f2d78c9f438a43d3dfb775dda72 GIT binary patch literal 12800 zcmeHN3vg7`8UF9R8}cA<7m^@83RfppT6qM+I80SoDk9ceQiC0^SQ5zwc3iUQZg^^k z_5Do6fkD%D6d$c6O|NQ4WkG12Z;txAcz#u$!R5N^M;>8G=v9d^~f9z~@tg*0#$e4j(vPgGkS$M_*Dz*ayV>_t2x;TUc6k~3#ZQ&jFlHbx zjZAmB#G|xC@Z>oET=k2WlJR(Gb?$K~D_zT$Qiv0gJ6(<*e01Mb#K(CeO^5~URm`+R zRAaWvX5Ugd+M-S;~Yn7nAWuuRhh>Ut0!%SW!tiilpn8Kqa;~vB2@~%TnSLRXg>XGKtmG0tN zG#V|HAzimB#JUf!>3mdr#7q5MiF}rqUkF$`CWWS?~g*@5kOu};ts3{O5DeLZ4m;8ERwuj#<@4v11 z7=Dza{Rzm@j7~QM`E676mMvSR;%s)8)OK}AwyqBS_tt{~T9@C2K(V*JAaL187@eo`PPKuY6?7yr)J&x8FqV1=hi_#%7@D8{LjbasqLNb)Ikdpv1cuE4Dj;P*sx*^XZREJ*A z)x~0QrBF(bv`VQV_0a{1 zmL@MAT^fxKnY}2MH0c?MCCRo$e!+}bvq{qmoNdRd9(j?p97tXZ~XG*c9N1SuYSclz;tat5|B40=9c9-~N=9Nj= z>Uh4p$44mrM$|LX7Zs3x!_t9D-&x!}w7>M6+oiUaK7w>WdWZ_?k)x%@>B2}4N4Na6 zmVZw{`8k6*>vDZ_(j^0x-wQWX^_QRQOY+N)lEU)aedK?skNh*y(%4^}76G3|{!8if z*t7#-O4e9EzU_KhYrXROMcBFzM;mN-v0V>21n{Yj1uKPf_A_RmlDqF2_%8L$@x+^5 z@BYzhJ$c+L?nt?@pN>6bGj@?nuovYu0pC;Dl`h1w7<)!%4+OX5ZL=d!W4BvF1YU`J zB5)FMgO9*mr;D+vbH&M&sq%wFV6;JXH50cWHny~ppU)R|eruC85bOmPsVnwysO^uv zW%efI56RTAl8;k8GZ8rlnu%N`Kj`rUgDji@9CWSE(};~eYQvkyw|9Scp!(ccx;?D) zY1J#+V}rkse%NcVXnnXhD6CK4x!LR6)TkF*@@v$DI!2?AKSB$zMph$#m4vL2rB}yQ z5XXX_55v01V`-^OwdvtzMeMY??eI{qEO%6BzaphY-&L!qfHzE1~Oyj~ki~afit2>|-(ZuY*f?8EB`gmG#-t^as*i+(b_3`IT@0yTbuRf~;^(weZ zaD7;-){4(-mEbk*`ibYybLA#J7zSMD-0_J7#|OvR0gn&bBmyqn(aX^N);BEa6FhQt5mtYLT*X z1sgz+Y0!g+xh_2dBF6j)MDOVWQ451DFC)#h=QR*9=070vCg#xZ_JVl19YSZs9AXcq zq@0DAG8?R6n^`U6QVWvNXp2|BD1omxg1AB%`3<4Ai;mfz?Ny^cfMxvnXU`C>)E#;k;iZ&@Z zXkQjlH_geL9bMcSZ)}V9DW_dD``I!4hMekAitRu~XAf!eoCKoIr~2SHMd=Y3gz z`F7A2I30)kB>wbwww|1aqdSlAD)`ucAZABlbc5TO1JyNU{Qi-Cbg05W`#)6u8a`j- G{{IIB1_6Bl literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index 97591849fd3a702c78859172afb9d48ed1d6410a..301d3e61fc37a2fa0ad653a6c193a8899c0bdd56 100644 GIT binary patch delta 457 zcmZp;z}#?!c>@a*XAuJf!@vLk{}*rOW!lWhSU7nvv;8EN9M*z&^=^if3t8Hk_T1Y1 zi{%(IXG0jTo8ifujLefa)|hYN?9i8}D+Fq0;9_vCNKP#%$;{6yZe7Yq$IY#@sw%Ze*Tl@&z|zpv($vJz z(8SctK(C;nWOHlwEPkmTpqsunGBCtWU|>j{$H2h5hJoSbb_NE)y_+qoPYW>iY-a80 zG-Ksp5@6`wTz_aObNyeSAG(3MoEZEV85kfuMj(#^C8F_ySFUsA2=kU1yMCc)-HIaEBp^!HU6y!39VoLpvrRhAorbj~Q`;Tn*I8 z(8JI(dFf+~$!m_O2ubZ{V6ZyDz_9581H-QyK=<96Y*`(!+35H=nav5cf{crvumAvG Cl!Tc8 delta 242 zcmVV?Gg#Zu$th|$; zI93H&0{{R`v->z5AOUN$8Ch%+vjl9K4;qUA004G@007>P008El0054w003&Y001Ps zlhMaevj}{95CMy`gp7$cvmwKl0}