From 4b70989156fd31dd9b8fe8eeceea70553330293a Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 13 Sep 2023 07:48:22 +0000 Subject: [PATCH] Bug 66425: Avoid a NullPointerException found via oss-fuzz We try to avoid throwing NullPointerException, but it was possible to trigger one here with a specially crafted input-file Fixes https://oss-fuzz.com/testcase-detail/5265527465181184 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912277 13f79535-47bb-0310-9956-ffa450edef68 --- .../poi/xssf/usermodel/XSSFGraphicFrame.java | 4 +++- ...inimized-POIXSSFFuzzer-5265527465181184.xlsx | Bin 0 -> 10483 bytes 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5265527465181184.xlsx diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java index 47d9c22dd0..0ede2c2c5f 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java @@ -54,8 +54,10 @@ public final class XSSFGraphicFrame extends XSSFShape { protected XSSFGraphicFrame(XSSFDrawing drawing, CTGraphicalObjectFrame ctGraphicFrame) { this.drawing = drawing; // protected field on XSSFShape this.graphicFrame = ctGraphicFrame; + // TODO: there may be a better way to delegate this - CTGraphicalObjectData graphicData = graphicFrame.getGraphic().getGraphicData(); + CTGraphicalObjectData graphicData = graphicFrame.getGraphic() == null ? + null : graphicFrame.getGraphic().getGraphicData(); if (graphicData != null) { NodeList nodes = graphicData.getDomNode().getChildNodes(); for (int i = 0; i < nodes.getLength(); i++) { diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5265527465181184.xlsx b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5265527465181184.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..3a25e5588c1a237d92f0110db701551391e16873 GIT binary patch literal 10483 zcmaJ{bzIcn(xy|o5$R6pmXc2CPU-G$>F(~7UO>7Vq(!<>q(i#j1@C+1=e^h254-yZ zXZC!bnKSXsk&^_6KnH;VzG!(SB|x4DJn*}YouP$21O4NBd2FXy_v;sdhn{eG?i;oK zj3P_gecAO)P0-^OWQ^jp2BjM3=giF(@CX)FdC{kL1cJ@oEQmV^^5=LjEJ|?EAwQ1> zO?RAJ*?K}#!$SpuLo*>`Bi?*H2!V>Pj^!q(p$?Bma3DU`-nHPyWmLhVikIm&eM@C% z=J^MBr0s~I}d3-~ey38qi#&?pf7>HMJUh*>l2sup@@`un$qFbE7cL{pcHMw&|<3V@W(mym3bSJ;mXry=Il_aQ>b(YL%2J_a zk{tT9B-Em6@`lrYNTRE%`=M^Odn?mLC8y*-w#_G2pfkj=BwKI-lDHjW=xl$kCwz*yVDE-1p(QD`kN(@ftGx4Z6If7 zZDY@%XJhkd#&QK|S)jMKp3syms&Tb_D5Qmf3I-1re`$mGv01oQ96il!Vn4ZlrMiF_OgWGW9-4JTkykTEO;hw3hyUQs3H{WFFA4JihQtO~$3U%Z^ z(MI1@<|uN68os1ygfGZV4#aSFwPMlazSH(2^NKGt#$$tE^WPi4@GDbFS3Fgj7~Y;I zc*9WtW=Gt1+f%PLmm|*OH5Z2iCmH)ogn-rV++acY@x#t>)|Ue1e>wM?RW?zGV&9NA3vU zqKn8GI}MG~3Wo7AVb*M9n))_~2y)fnO(pkTOJt#AeK-l*k#o5i!qWcB zhs|dDqkVy8(UCYgnC*5)|cOs=$-ry=r05S!L5X0Gb<~ONWsk<{FG*1 z4)0Z>9n%j3uD|ovXNgD3if-GcvLRJ;L#%j`Uco+EuQJ5{lMm2(9^iko9?Em;8CcsH zKAJBgMoY5$HG1IT1&zeP0*fUD>NH~Eo**8K4Emv<-85txQmje6x3zM;3>!lW59gSx z%h;ern}XI)$Wh5W^S9M_WZ8`<^7X84Y7AdA;x9XDbu%X9NG!)&QidA}7CBt(`uyNg zJy3b)6|Br_5jy3=c~|`O--LaL9Eq?E4Nz^u)ac_=g>M)*d09sIx)ZD$TF*?Bgo_%I zAmRLrqd&jRi&vE6od&Te9!B6C-yiU>xkwsM?DDVM#;)yF^@;sfl%vLkE){pW5AftP zueJ&oLE#BwO|tc@H>71UW_})cwZ4^(iK8AVGJRJeE)(Xb{PpIA&M;D6R#(Gjr^#j< zWJ6utbw^~z+VravJq$iW5&_!tq*GQKnbOFphbWCnsw<2O(qI{nv)z$zFCU@i&BE}d z1wt+G*N}$}gxbY|!N5e%&cPn|0kq4L?5jxIFR&rEUZ~i(><?ov`giD5fbQ^^z(K5U6T*@@sMTJU1At+ZZ zZgTupQwb#JST%cop=RN}`+4XEQOKyTYY4cKQhKK*pb%<17Yp2vt8B)qp>7)@jOL^N zttFe(K{0lbnna7dTw^3$v_C^>F-u7dSv<2Lso!)><(vsM9(G8Dkpx%x^rl*S@nmYM zWgfKDSKK(7hE*$qNooJXIT5{AgA|w3HsDU_)gG6@@85W!=4=jAmQp(h;%lIDv9vDe z3}A3tANMr{I48X*5{R9sISwT>4uiNB0 ztNyoQ5?En$GzL|GD6{Hp&}xidMPAq$BRLh%0=(n~B>+@AiQ^6Lm^i@ zu35QPor|Km;b)R}^6^Lu)xO(_0iICJ7k`VM1pheFzskL*^Ue4eMt>E4;{Y>o#uq+oys~<=7apU? zf+2A^as#R4NV*p_TsN zfVShfV(oCZ>_hO*5s!9iLzh28D?^U9YLPg#f^1<=`3Ni7ud;_l;s=!}ZvQIQP_nVa z&79Jes#*4f?hMkjLjKUhW*c22bVZhzU3(MwBPjGNAj$*4M~(r;y8m6;Vf+IW18WOw zJNqX*3gQH;x(ShmEA?%C!uLt7414Dsv>YeU!uya(K+!;@(-yF}N4hNi6oZzAf3$*< zI-#rUci;17M$opE*?vUfdfnq<0SbmNsjsRgoe5srKwQ@$VH!K`emivl;;8nOAN-m_ zttSfVLG_YSYY5#vj4|Qf#!)qn)({-?6Iwum?G{9aY5aB@niADHw*^I%2V)yY&Nc+9 zI2H}4a}8HqIrAKOoF%gwv(dJ=>=vuY$bkx{-)484op(+uQ+bTC+m5g?@B?dwTBXq8sn|d8M7o-=JAP7!MayAXCETNCj$RQX5Q zI2@%YUympw)~PnKfo!FO+R=Tqqp<7V&1trXTofs*ZnQy2k9jM~k&+zmb|2-G=XpN} z`nE@$=p}4#5|i6JzxzVo8T$1`NIOJr$yo__OSo~x80|{{V-f>514Ak(>^XTpoy^P< ztp+>2t?{`-n8ssj3K9G+Qz~JJLB;Nkrr~WpvVQjX;m#3@la+ALMAxf&LA%{^cPvi{ zi|HfiPF;Rj#g*_<>tr}UX*yJBUj(GFT%e&FZ_Pkl-9YDJ)F+QJqinQg^PJ42D6i3~ zzH<2?A4WXDw=T__t=rVN0`IwPN2gdl19GeP0rj9Fb34m*DCyZ3ZT9Fka2!K*r5$M? z`yIqzJX7X1JD9h$Xldw*O(^8H(FxM9EzJ#2aRsQ!oL@vcAwn*ukm=NgUrCE)K~;k- zq+0Y~4w&`O#sd15g+Ox_Byo-hf@)PRRlQEMK%#uf=%kj0aE~EUG@yq<+5xuB>~WGD zN_BZh+BZAR_%&i6`UmHTA*-=fBSkGyjiIjF65bB*vxM1}54 z^KHOc`z%DPxz33}a#vUqBm@9mlD~!Cng)EM?TQ%C@H-Cza?~ym7%G={49^-kO>ch-LhR~F~iT?Yjfm*YX5b7U0|W7G_ZPXNC~gGiIq@p zY>ty+GYV`r6w|9!v0nk3%(VC}VCMyE>$A~-9^PtblvIu$exHHdf!AVfL*q>B0E@L#F4iG{h4XJOTy* z0y07Vw}^}LJmQ)d8Uo8p`^S%`KoTMM|Gil5qA3?LK}plTANjt|huThF=_PV?G?hrb zV4bKL#Mzj%to@73tlcwXyeVio#NwT&Gpu~J<5CTfIdOn zU#lkC*B}{8m%7=x5ZPBOgW;VBm(Q|sV|Ost#>$nFOy&siqz7u4ihpD1X|Q(!QKQ6S zUfv)-3L)&;ly|M=<1! z3oqfpWv9M?U{zz1E(>8k!rByQnJ<&mGb;-b+3Q_eg0c3pY$Hq3>k^C+nXFUQU;-8` zuNr4;xDI~MAXAZOr1Qir-4f+e-_8>i+-zTGx_=(-n0Z6b96VUCn0^@sAy1Q zEkFfy1jk)ItVF%!a@2>R*rYsgb{@9}#XwfgKYmE01*7Ja+Dr{>sE=fv@3?JOM2Op( zK9b|1%EeXyY!m$E4H&=P_CXe8k6g<$tGe>|Y?fx6^YrwKBG6_}7;wf67q! z3}mv9TP|om97M#|e$!k3ARi}3NfvYtURRA5rXH(C6>@WtV8G4c%YQ5^c9Xo6qD428 zKtJ#$2~thj-^6imZ`F2jl$HhYD6jR$=G1jQ4zo_r4|G?8}>P! zEvb%e7m41PN>RiouLf_MBW?{g_`g7@53y1Du@p)m8os2DQz%yi;C9{fB2Wr!f~r$< z5_(17<0_P*BjF%!$=qrVhCcxM)ki!e)oWbp?T?q8#mdktleYDs`mfF4k18SIBq)i{ zXb{zLSF*EdJAy2o8>yGn0%`j0oN3;9%kA^PV;t=q$@DE?ykCk^yL005SH`~xN3=l29Y1TU^xq_9*4Gz|?gk6GR5Ki zuwI-B3jNRnCF2hzyf=yJ!g}QPCQ>E2sGCwgK{BG$SDOXVJ?|###=qC6l63{S*ELi* zFg~Q&wFuR6UsX9?bAWz5#BA}X>Kd0{b85Dgeex?*)&J#jQBqM=E<;I?& zTqqu8tZ9K#H*%aE%yM%b3#ES>cRnQb46p)3_XIQ)huR(vD40YVh+tF+__y-1%4wVS zx=CSOByF|k6j92M!!Ch2I?pS<<}%D2ZbBflzykAu*dby62;XnGrw0B#ZhMMPR zIwQ6ZT?(?S*J|5Wl|6%q>*W3+KIos+qvS05uWyWZ*)#bH&i2?1CID@lI^$Y7G}pah zPIOq2rOZ*+0+)M5>Mc;`cqUVTHhlgce9gPmAf>9(8f$GwSo=-gFQU#xAD|{~Q9rd3 zGV#o3srG8jMc{EaMNK=>m?4ZEjRl?EeBaCo_7`r@hN#g~JkAQPDd=xpfb|qwZ<>c8#5t9>+YZS%jo(QV`OR zbq`UUTQPYrcS3eM)~}Nsh+dUccOf})kKqogluN8`lDJB@)-cCu zkT#J8d2a(M+Q@;@XV|{$~J;55+gUwecI`|k{cdBS$Rwz%gLa++lmr2`+ z%p$LJ)u8G_F06Gb0jzz=^bc7tm-}xq$G3ysU)-Z)5AQtO9`3hWvsnC+_}|DwW_ey* z>8yC@-(GDk7$db!ZKQ-g?Dxxh-+hPYjV|pd(&4?mJMJ#h@jmarKw>$(<G?`GZ#wft8K+Ts zn9b;yz1TQH#VE}Ia=n!|lsO+_h}f-&@(`k@$%2Z<&IFU>$k&;^prGeeTpB$TPLQh> zwSh;KhyjQ|rayjYSnmtd9TF%se8E&kd;ucsNQz{{@{uFm7G)cyr)LY1(10tY)ImAN zT`eEUbN1qxwv?Dk)ZmpJ5^^pv_j|k|!ZZ`kJRT(gK{Y@%x1&L%Ara!^L3A$NI>^uR zwYCsK?^a7sq4zR(U{oT7iuGiK9}oI*@WGPD%=yXEj48eK%#gHG=T|7sAX|iEoXpFM zep)s>=z<;kn0g_E@}9i$ZXa8D=)Y~XWXSTI)+RHPxPC^$xt9cfTgVyzS>2>{1qOeiw zew@JEF30(8p9Bm@+YXka@dSeeDua8si6d5>B7+7=Au3G%qzXk2c4_Pp3n}s8S22!r zHGqkU>Qn|6penvN_|Dj8ol0bNi~ykuLYISbU2%vZ*L^c)d2@KDR%_%G_dZ3qNl;MD zN(ps{Nvad1!a2*f>?ML{u@+rK@jaWqrR646x{3x=M_!95xn_O=gjDLL93FD7AsY&= zS`24YZ{exm)$oJ3QHoq2w@(3?6k@{37;?~52PK-h76SOFj(^&Q$a%A5h2Fz%X3ez! ziy)!oBRbyFLTs7@6VVl9O_l-0=r>}}{Uy8CE)tdCYt@8yA4N- z>y`0S%j+mR;?Rd_LQ{t&8(Op{-)$15RE!NxHdgWNWC(xtY#djgT$Ja}Emzyy$8Zfu zC^E({vDeD8YHyHeaTSm&{(3gW!~4nd)5Z%Vh|orxu$9H~36E~Gsx~va@0wH^FRdxW z9_m!DUfF79=#LKdgHWvF6KV6P&@=n)X}wQEvy!4ROLgAM{@!neJhSIEUVfEnJ+mY5 zx%87?hkcW;f%E)<)*5=Ik&N8@LC6gb4|8;KXU6zGYl{eX8EcDj<)-uenK}vL!Y3JQ z(F|=0#GQy`ErpxhO)=^t4eh<4B{w>U^@hzLC%vZSV&S&ky4zxF{J=@dyB3*XYZzyJ+ocB z>c8}LDeHGe+V+77j#ub@x{$^XjGQU%&`O44T~h3$K60pS9%seOabV3=VUo(-vM=V} zV*j9d9OXkLRW&wYLE6a`tFX?>p>%|F+&1R8)c>BIt3J6#>WYINIpd+a`4U&weprrihoaU3DXt zG^DTAS)_?E>F?ETt^HAHObS+z%TY4nYD{BEwa8o@NqE%}@RLN`<>x7qJ`weGg5O&N z2(!;NB!7Y92`X=f)`2chfYkUthOczu!Gyr!yv?@>+CqYPPsX@6rsf1j0ExfYynKKS zaW#V#p7^eXH6eW%I8b=zTay2H+3B;$Ci zIL#41+c!VjDrYj*ed|Lm(WZ-{PoHti_^4!LLW?|W0N~JrgYEREVrsFyym_2YA z5QF{hLceTnGBrt1Ot_^=PtGYZr4)R5UoE9F$knV_IbA<@*x7pf?aS(`qzK5iBEBoo zQVp9+5l+%0y?u>%MPXR5R@l0;2)~WB?Hzmwz`3$>XC4@VZoQUeCg4kYRJ1us$na5q2V*}p)gZ?n zD+W>S7`LNX>t>5oMEHEVgTI|tqBD~;&Jj5Exw63g0$h(k5tLe|yBLLCu#{bL3GtVc zbIx_0#heNa|ESKE^R25S2v-!J^p9#$tbN-(52?(!M(!2;_@m_U-3=~-{237qI3&Si zuO=t28FtDZoYu!w0?z{!yxKk+ORWh-+@2%UmC8Osmyk@2b^-)O=C6I=zZ&*O(4KgT ze-J>iva(=|$i0VNp@q&{e#C;R!6+ekQsM6o3%HvX#+|0?Zg0+IR0v5mIrgRIuSVP} zxl{Jb^)!wI@;^U1MilOruY>jAL+%{I?JQf9k(nq4`t6 z^Lqe~cQt;?HgKPR-rV?e_4Cp8<6VK@QUpB9|6cw7HwXS){(Ow~*r@*&RN$qO=hJZD zQ2eR4_*294nbYIA?YDe~eXijbgnta*{#5pSB=b0?`YqRR&y_tJTK%cwIV1beC!z$7 z3V%P*?@7*|8lLlzkIe0Fu>jiV-x~hpasO2FoXLA6Eq_Y`&`^J<`Gw9O6y~2ApHohc z0p+)}qCRQ-uYBO2TAs5ukMz`UF#_TR+}FRg{MyuikX3&wd`_nP6LC|Z4S@>(gZlYX z!}DhMk#zYjB$&T6JdWL-D40K&J}-j)dHi~T5CMPu&))b?1TAG70cVJ3Q7{0qY8D*kH_c^;YmX;~}ce{bSH5{H~5B=C@efS>|jJ;2kB^W