From 839ce4a0f4e27959d4001472ff12ec62aec4450c Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Thu, 19 Feb 2026 20:19:41 +0100 Subject: [PATCH] Avoid NPE in HSSFShapeGroup.setShapeId() --- .../poi/hssf/usermodel/HSSFShapeGroup.java | 6 +++++- .../poi/hssf/model/TestDrawingAggregate.java | 3 ++- .../LIBRE_OFFICE-94379-0.zip-57.xls | Bin 0 -> 37376 bytes test-data/spreadsheet/stress.xls | Bin 79872 -> 80384 bytes 4 files changed, 7 insertions(+), 2 deletions(-) create mode 100755 test-data/spreadsheet/LIBRE_OFFICE-94379-0.zip-57.xls diff --git a/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeGroup.java b/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeGroup.java index 76cd1f76d1..e1f1f9c2fc 100644 --- a/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeGroup.java +++ b/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeGroup.java @@ -355,7 +355,11 @@ public class HSSFShapeGroup extends HSSFShape implements HSSFShapeContainer { EscherContainerRecord containerRecord = getEscherContainer().getChildById(EscherContainerRecord.SP_CONTAINER); EscherSpRecord spRecord = containerRecord.getChildById(EscherSpRecord.RECORD_ID); spRecord.setShapeId(shapeId); - CommonObjectDataSubRecord cod = (CommonObjectDataSubRecord) getObjRecord().getSubRecords().get(0); + ObjRecord objRecord = getObjRecord(); + if (objRecord == null) { + throw new IllegalStateException("Did not have an ObjRecord for the HSSFShapeGroup"); + } + CommonObjectDataSubRecord cod = (CommonObjectDataSubRecord) objRecord.getSubRecords().get(0); cod.setObjectId((short) (shapeId % 1024)); } diff --git a/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java b/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java index f326f17b07..e14464ba80 100644 --- a/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java +++ b/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java @@ -139,7 +139,8 @@ class TestDrawingAggregate { !file.getName().equals("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5285517825277952.xls") && !file.getName().equals("clusterfuzz-testcase-minimized-POIHSSFFuzzer-4977868385681408.xls") && !file.getName().equals("crash-e329fca9087fe21bca4a80c8bc472a661c98d860.xls") && - !file.getName().equals("cf9f845e73447b092477d0472402a5baea4b8c9f.xls")). + !file.getName().equals("cf9f845e73447b092477d0472402a5baea4b8c9f.xls") && + !file.getName().equals("LIBRE_OFFICE-94379-0.zip-57.xls")). map(Arguments::of); } diff --git a/test-data/spreadsheet/LIBRE_OFFICE-94379-0.zip-57.xls b/test-data/spreadsheet/LIBRE_OFFICE-94379-0.zip-57.xls new file mode 100755 index 0000000000000000000000000000000000000000..ee6186ad924d1aa365462bdb8e80b71d7f06cd45 GIT binary patch literal 37376 zcmeHQdu$xV8UOZfZD0Jh^T08Qb2%rFmuZNBIKhdX@Cf-MA`qa0hWdfeB!VQ=2~ns- zWAdOtLurFVF`^HoPzh*JN)QjxDyAt=377I})zGL4Esa2p=z(Y{70vbco4xg|*K@wL zeHTBnpFNMAot>Tic7F4H^UciOo4+qR{@5=n-xn7xm!O=APmo+kx`Fsg`?yqaJ|5?x z9bSSsl6)FN9GDQoi_FcDPbc@}@m=zLzb^qX555dvAT=~nSTw+op^)+`_)*-JT*OWjb&KYvQ$`Mh1 zu}XPfmG_=XIbSN}x5yuo@3CQvJf35$kPg`>Epn@j*0W)G)=}q=9}hX|9F|MuGSocW z=ebhliKQv0%B+$c@LH-DR97!tAC6qQCUWum8plzUS&ep4)i=l2u8y|d=*l)r@?=IL z+j$FJW%VXhnRD?nX7$VGEYXp9xy+L#B26{(!j3vM)u4{<6y}N4M672(j;5N%rkW~q zxy*Hy&~$0jn!Y6@QhH11Jys=LE(-vMWF2~|=PbmTm?)>A!CjZjWq$vX+|^Mf_0~W= z6HDq%QFWRq2f%J)l|*GTT!(7T$7K>;)dBfeJdD?FQ+Jr@hMoSIxAZ`Y{Hf90YHMq8^SJc%^dR3(oQq3WZ99Z>kMy9NcKpRVJ4M=Y+=D`SEB-MGuT%Xo8F`T2 ztUBMlQXxMoLV|=K3tFTVt?O3&MbYK#6BGXV^0Z;%*$wk7bkpp*EjkrH75|4!43>z* z3W7|_ja9&pn4)q;5H}Kz@dpD1u>cZq8iWT$eeRNlQ3Kp~_!*JiD!xa>_o_VKR{lN8 zzgPK((U;`QuT}X+kTOet1K*HWx(gBFL084&4ZNxBRDP%O?=r~eU5Fd9Tczw#@$bOD zK@JMzDL@EeBc;VwLL&>M3&F7hHpS6e z=|~gcOcfJhql2c^kG@nTSjln8H(8!fJ_mdboar3M2Lr6pS!tiqSwWz0Ke8WPk~J18 zf|xKc7NTDUpFK`UzI@`7x7W0;Z74)an>4Aj^VHe-%HO3@IvxGcY$_je3L-ZkFPoDf zl0cKKV7IzvkMhsKHBdD`A2pooh|h7vsnXkd9+L?A#5UB9e?jTEee=x=zIbJS(}JT7 zc4)}8C_7*7R6S-~n(|9j=PiL^)qnEYP1UQOlow1qYwYJYs^^Tc=ZwJ3MCD5)7^^{g ziI}lDNHb(YtS{G)2*RDzbu2Ik$Gq;5v#jf;LoB$jD?JzYg0ruKwj&%;z9R*(uj6|1 zZFmYx=MmP^QUq2(dA}Vhz->y!5^01ouu0uPWHv$y!4i5q;3$dh5Yb-pBA~XRkW>N+ z4;(93r5UmwI!q2;M<`e*n-p_v(KaFhi-~MCD+MA#etTHJ3 zuQ0A?5LvDKPCl*-q@_LU($XTEGohsgp_z#|Urv*3RT}RiSuE7HJMnUIh&d2n4iyDz zGrccG_i|Y1T4u7S(+ZB`aY;iDS&zZ0i>x2((+FqN4R$00p-x@2TX8kYw;k*WirV1Q zk?gpMcrz0clr4493ur!gcb<_NG$pFPxp$(-4^hbrW{PY*vqXS%g`c&Xr#B(liaTGd8a19+yteg{!KDdTA z7V`owa@;Gp2r@mm0%^cyOD;1D;2Il}>wNIp4X!~+t{-f`->IKb`v46eWInjE53UtZ zb<=_C81hhZr3P0}3$D3Ja?OS0iX?RF9D)mjnQEwo$IwP_2%?FEY9VQt@^>qLkMj2_ zKb28$m2n(OvaJffbo_5A40di+@P+D3sDgSqbrICS{!oe{O=;-rc~W?`5}3PoX2naF zzSZyuOu1cMM>DPjl2PesB$PllMe+b|r`L@YC6N3~2c@T!&0HjkxwOZW*3wrA#AK@$ zN|cjDN?m-;D3?j>85I>tScUZ*V_X;QxFg)U@#b*rmaSXs6KAY^Fqwjitl=|4i%v>^ zh~}Ol5Um3X+|q7P5Y6`?I`$w6Q&T#K5*kz?pT`J`_8s>)Eg(4_AX?rFQIumSzA^2!w;HZh^!Enq_~juFm8r1pgHwD$=ns*Tb1q(% z)p#-GKKc2kKc|L^HBV9qYZGZ&MC4=iSngh`N+xJ~sSB00$qB0h4Xk#Ib6Dv#Z68)_ zMGhKo!vDix-ko+>`#JD=088KUuqu?p!_vTs5Sn*p_q1ILw^Zgb0yfD~#QIq#pGwa}SF`@^6Z%;6N_ z$iYB2dB->B!+>u-L3UqnA2ZZJfN3PV={w_N4FR19X2hkK5AbS6ECozXj~Vd-JayL0i1%DGe*o*P zZALVt+9;A|pc!^x`(1}((%EQ%D-FwxSO#XSr09eh@sFr34ne~)BX+9p`}8ld)@!Is zw0#mDc;rR1E#|!J#T$urHM7Aa*0I{*#?!i*X=nu|MDt&;4CagJcu3dcYC}r3eNweD z8dd{DixR`Ia-c@(pBV?y=&-!kslAKtVO~2pHc0(8maw$j;n0VD_At)|k#BiV4jD6L zd5^Y5Z%Q}JBWwtwV*rzGGCn9}S`eil=2nb{7cmsNGz2`*n& zv5h&%)}L+Y^VE2kRf{STvI?`ZQ(oTX3s9lFPGnR7x2I+?m`a%su$_bcXlQ?Xj}#Z4+Li z{Z`Bdyq-Z?Vy#w}iG?>~#S%-rjpxy=nb@IQScxu8#rvw=RZ`)hE7L8wNpASH!B&|C zuvK7R#ApMXPHz|j*oHpMVZk(cy$`nRf8N52-mnL~2|>0mjF~?G&aIwT$<&O2?d&Xo zjo%?1ZD7-lg$D&TdsmMeG($c1!IpineHS7*wen|;h57ynvQ&24Dyj4Uwxp6?)vKh> zz;^+|8(OwU!!2!X(YEl`Et{g@ZP6Xu!W*I;(eTo_eZPpo5Aq5=x@M{F_F9OOVy!`% zg;lOzRrhJ9O?4-#vZlIIpGy7qY}Gv^0etv+CqBq{Fj#@lB$G*;*R_{VOb0WvvwWhq zwu|5P>BJ|$Syf4Xj5|56%RH|e*;U%>aPLuVe;^Y`9O$K@9XLTQHaaq7^8=5p(^yv8 zz335daK;35J*KAS!3N>hBZ4wb+qESZN7x{$${L99`Tw*aVxDY*s20okbl)gw2ge3E z^0n6<*xHW=( zxM<+1l;D6=X&X7s%>(bJ>Mu*eHViVpp0%q7R@yWQ8S`XYmavN+)e0GzKpIW5gmoIr zvV{CBgj2f_dC-R}n3d&-JOEkp@D!03wX$S}7H0ir34cdGjcP_rmhdY!?nd5*G+&lD zUc5c)=}1ze9QN~W$2?>p9m$THh&MAKL8ESqZTNLa2$Y`dI?70MhA+(AF{qNJzJ;gufQ`?5n|rc2y^)Y?FNSl+mzhZ#L`!D6SdL#A#cgoHw zzBBTUW;)t+U_MuK1pM(JnhUvPiZ(aw8&tM;+IhIOi6&A$0@lha8xZyiDmxDr0Sip; zg6}!udqwz0CLGsSV%x4@jRXvPT!3ZSg~AAD!bRY!;by_nWKWAGe}skhrMYle#V_;W z7QofOod@?7INF^!-^w`_+RC}wmo_AR(~_IW>)@8avAtc4upVw1+;X@ExJI}Ya6C`< cKe#iE@c2IY9Pl~dbHL|-&jFtUXBY?m4+&Wp*8l(j literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index cd4be7f1dc83d8ba098d205341a9fde76dde2a41..b0f95e64b3c87029e6bc977a9783c5d6f92109c3 100644 GIT binary patch delta 2575 zcmZ9MYfMvj7{>qaq2(gf!Vp2Qqo7Q%l#2x_7R4JNDl%YR@LshJRD=L7WK-j^7~`@{ z4aweZ#yPVO`>-X8A=)g)8M9AwUr4rWbLvEQac=Xr$-HdJ-v8;NdqR)-~4F*3YZ)R+jnvmEMw~m)pC% z<^H0+Z9OGQ&2Qi2-rm{kZVSE?atF7&8#ioe4sGo0-sIlg+3oIa3%M7xwA8k=1-n9Z z-JLtSs#J`bkt^#HI6RN(C5lp&czd{%E> z?=9U-@*za9$g(!QikM95AG0 zis3i*Y8m2s5!ZDXoEC!7guWen?qXe@}Y^cIm};b`G?6R@E&`$+~-y; z55jw0^szw?xzsJ=zr04vf4tu z;4DVmy<94ACIXfK7EdCVGYPO1aFvD*z-fT{1O~8kO70ZUaN zs;bJYO2=*$0;=;QH3M)a;8qPM0L}tr4Ko3&BQX3$9vv~9S)jAA+Lv_OBfq_E6CQDUQR8_NC<;89@0*>m`BES~FuQV(M zd;##Dt||dsYN=WpRkh5lD#h+H1T+>(>NLRRfUjui16%?4k-$J1V5_C7HL7Z*SyhhR zl?WKosTF{$06kuTe!$g$%LN9e1Fo@Dt%<5yYgScacP#=w)u}T8*8yJeQin4Dxc*61 zkyKRy1}#;=sHzQS)lBSecv2++&RKvPBQSiSi1LU(D5mwJZ~X^tc_&M#GA2p>>&=!d xm3*}#gPVMm$}4=76#stT4gTiXMe5J7jpIE&x=Zi!jxu`9XvhygETh<%{{dv<(yIUf delta 2808 zcmZ9MYfPI}7{|}^^0t&x+HxD^QtoVWS-Gu+avO6Xj1>oiZ7{%ri)l0tiL!(b6G_x> zx-61#<}&ny`=Tz!4Pz5yX8g8Hv&@iqnGsjwt1o=;YCJ2ZpQez#-k3;8;^>_&RQo9KQuP}@MEJ-Jj>i{D1Q2q<2g&bjj_hL zfrK5+;GLW8d@pDE{Ue9W26o1r%N@OBTKe(uOLMm#?}xxhT))r=A^Anr?J7r~7ww$rCAIlgl$41x8a7vCb_uL2L{^w^*7@0AkFL8Bk zZEgMc6e6qVMmR)9OnBLhq{PAAxX9TgCQuD27jY$OEPD8J`g4DnBF2=lqH&*Z3VQ!7u2X zRh|prd10|K11$@`M^MSQ+#Z2gHGip8N=5~Srj{$|wjp|E^U z7N=ryDi)_=aY@S$JU3I$(tss+gDh^v;#Mqf#gZs3Kk^e%%UNN$NtPtVlB8IY6ic$S z{4|p#N68Xpk=JHH4gAcjwPA7jtp>H}~XWS>Y{tc;X*^Oq4tPEm7|BMcgx1fv4v~iLnN} z6)Rr!v3xuN{InnMhn5~ zN}zBXg{LqKJ1O)lR=;Kyw>gcuhz%%gKx1np>n65_nq?Q^1c?;ZQrLlEIElibVhw86 zI%!QNwoYN|G`3!{Da6)Ov&&+FR0w$V|S!7_Uqwh4&J99K&!Hg*&4muEbs4sSVH~2k;Wx zqOdI*+bY>?Vq2+Mb_tG^L*acCc3>FJrLax0wrSROY0V?HU18fbc9&%HiQPrbE{h2Y zDD0qcMNCjg;cmscTeF6wwTRe|!iF@qQ?i?h?WAUtr8vPB3h$@zH4MY|P`F32?$NAW z(ppSxm%?^wY`0`fi0!6kzA~Jkl)}9f9>g$QMq!U)?a{2g(z=z{UWM(|*nN`q5xb9? zErP!h8-)Xk zbwINYN~@pPL4_UE*dfUVh#jJ4O+K8UhQbFZd_;t`6ds~*#s^30gA@)ct%kK$BeGQ; zu_NoP%F$X+;e+d~MA$&#;b<6{DTg9>y9$Ca4*aLzjJBy)0|g%5?T2LE=Ld)FYWY*= fug_kC={z%qPx)a9PV%Dxc-nYjOJpSg)|h_*zX-bR