From 8e40aabb187903a8d8cf60d6bbff23d3023751a6 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Mon, 7 Aug 2023 16:18:46 +0000 Subject: [PATCH] Bug 66425: Avoid a ClassCastException found via oss-fuzz We try to avoid throwing ClassCastException, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61259 Also fix handling of NullPointerException git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1911517 13f79535-47bb-0310-9956-ffa450edef68 --- .../org/apache/poi/stress/TestAllFiles.java | 21 +++++++++++++----- .../poi/hslf/usermodel/HSLFSlideShowImpl.java | 7 +++++- ...nimized-POIHSLFFuzzer-6416153805979648.ppt | Bin 0 -> 15360 bytes test-data/spreadsheet/stress.xls | Bin 60416 -> 60928 bytes 4 files changed, 21 insertions(+), 7 deletions(-) create mode 100644 test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt diff --git a/poi-integration/src/test/java/org/apache/poi/stress/TestAllFiles.java b/poi-integration/src/test/java/org/apache/poi/stress/TestAllFiles.java index ed96cde4e8..5171158965 100644 --- a/poi-integration/src/test/java/org/apache/poi/stress/TestAllFiles.java +++ b/poi-integration/src/test/java/org/apache/poi/stress/TestAllFiles.java @@ -253,13 +253,22 @@ public class TestAllFiles { Exception e = assertThrows((Class)exClass, exec, errPrefix + " expected " + exClass); String actMsg = pathReplace(e.getMessage()); - // verify that message is either null for both or set for both - assertTrue(actMsg != null || StringUtils.isBlank(exMessage), - errPrefix + " for " + exClass + " expected message '" + exMessage + "' but had '" + actMsg + "'"); + // perform special handling of NullPointerException as + // JDK started to add more information in some newer JDK, so + // it sometimes has a message and sometimes not! + if (NullPointerException.class.isAssignableFrom(exClass)) { + if (actMsg != null) { + assertTrue(actMsg.contains(exMessage), errPrefix + "Message: "+actMsg+" - didn't contain: "+exMessage); + } + } else { + // verify that message is either null for both or set for both + assertTrue(actMsg != null || StringUtils.isBlank(exMessage), + errPrefix + " for " + exClass + " expected message '" + exMessage + "' but had '" + actMsg + "'"); - if (actMsg != null) { - assertTrue(actMsg.contains(exMessage), - errPrefix + "Message: " + actMsg + " - didn't contain: " + exMessage); + if (actMsg != null) { + assertTrue(actMsg.contains(exMessage), + errPrefix + "Message: " + actMsg + " - didn't contain: " + exMessage); + } } } else { assertDoesNotThrow(exec, errPrefix); diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideShowImpl.java b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideShowImpl.java index 54edf47faa..70fb287026 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideShowImpl.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideShowImpl.java @@ -72,6 +72,7 @@ import org.apache.poi.poifs.crypt.EncryptionInfo; import org.apache.poi.poifs.filesystem.DirectoryNode; import org.apache.poi.poifs.filesystem.DocumentEntry; import org.apache.poi.poifs.filesystem.DocumentInputStream; +import org.apache.poi.poifs.filesystem.Entry; import org.apache.poi.poifs.filesystem.EntryUtils; import org.apache.poi.poifs.filesystem.POIFSFileSystem; import org.apache.poi.sl.usermodel.PictureData; @@ -229,7 +230,11 @@ public final class HSLFSlideShowImpl extends POIDocument implements Closeable { } // Get the main document stream - DocumentEntry docProps = (DocumentEntry)dir.getEntry(POWERPOINT_DOCUMENT); + final Entry entry = dir.getEntry(POWERPOINT_DOCUMENT); + if (!(entry instanceof DocumentEntry)) { + throw new IllegalArgumentException("Had unexpected type of entry for name: " + POWERPOINT_DOCUMENT + ": " + entry.getClass()); + } + DocumentEntry docProps = (DocumentEntry) entry; // Grab the document stream int len = docProps.getSize(); diff --git a/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt b/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt new file mode 100644 index 0000000000000000000000000000000000000000..a47bcf56be6cb28f04516024f166306a55173942 GIT binary patch literal 15360 zcmeHOdvKK16+hqiZITTnd<)^FQuts{u_6Yc4z@m)N-fq0853J;osy7jk{yyPv%45^ z#(oVG6QagQF3-o~xCf2kg9qpi|)y`OJ>!KEw*Y@|jcW-vHo5chI z~x>3V)-_m-cY`FF_)my07uQl(OyRc;~As6s%*MTXx;QmK?K z6hZcMC`5tjg(^;6`C&{w8jI&3`Vfl{x#lH^e#BD5VTi*K%Mi;EM<9+t+nTTg0PC#V+=`eICaDznf7Z*=HBW*~dvJ9)#|1cIDW3Ztt2;94( z;kyf-A9>fC@`(KUyf?B(3VgA9`^#V0WkGak218PX+1n+Ad6^3<7(AJWe7!7{R@4xx z!eN?NwvB4?FX1TMGE>9$jpym_BB@sMv`U@A{c6nDh}olE=fMTdut0jK+drD9^Z*3zhO0mne}3T-j4{EmDzRy7TZm7t{=cnk~rhU0)&9+si7M zGO%C#;R<1#x?zHK2<2l?&y;~iC^`m2amiwPc!Azt{iZh*h!8!iU=r^!_I8{&O~g; zN|BYV`zKhVH|XW%H^ZR=snnw&v<0Fpk%JD=XIO%a`R1rW=$}ba;k#7T>Nz-mb_`B)6cF8xEFse2QX=KF zi!EKGnwFdLNSn8$t|{cryf9}i^&n~_%~&e?rdk$PK5(`|ksIO?PRlOg2FVI#m9>&A z@lc`}UnG%8sQTY@zb3P0Z4}wKQ8sph=X2VvU%y_pJNRm~q&7B6=PWdB%x`DL+t`_s zPQ+QWI^`!#sh;s(*}qSXW5y#K_dbP9*oa9xvd4Q#wQFy0S7|EszRc?ElvGs}=FhYP z0veZ_Z$gTShDFjEd722SekbckOBP_04#zO>N!j8QG+JceqsNrnwS8@%Bjh)p4)6F6PBTw}zs1E#9J*Nd4lN7iolyyDeUR zeWWd*DcnTT_k5BQB2xb2U8bc)__Gr4(660Y^z~kV*@E!4&ePY5fOPm!xca3|hN(%pHy^Ba;;7qva37jm)!T0&JM_Bp^ZPO&bp-SGI)f z7klxD7itK{z3b{?@lZ5Pq*#1eOGxBL?#dGL#9kg0shvB-{+VG0(93j*WB z==9}iS0o9Uwqt@d5S)?@ajI|)PLjrnv)XB#9#Q~oQaqrc>2PmAS>HHetvrQNth_o@ zA8BjwTCkukR5?+Tzbdjc8gEWlTorCKc~W5_MxM+W)!EQe8_ZUDN9BpQrcO0-8Xi*T z7x*&N@fDy>$5R8N&X-+Kr}&;gE_JvQN-VwNmm_ahoYRVIc3J;%#4So$^GgSvv(<_B z1EthiPUwGy)IeWU0Qzaq4ix%rC0!$OpbzS^O{uM+$0vg3*L>(!wKxHN>|E!x1-z@I~he*(Bn@6A?ETMMmrD8`7Ta1 zoH-#=FS%V-ASd!w^}AC2eog(}seZpM7(jNwBUOymgItHSXT|S%=9Rx%wAtnFQau?9{C3m~ZRt-q*iriQFYQTfe(7MFXnBbJiDy2&(WBa=|GrUazGqT0V zN@Au^Rdj5?m!YFCjZr=5I2Gl~#b@~}O{wMRVu4a4p%-}~BwfhiMk8*sy6nIRZ&)rC zoUKS<(OYX36`3Y=nnLB2ct-XlboK0WPx= z#cArS!Ae|&a--A7-?IwqK^z96*%xBpRFy0rn@b}ybZMGKRmd0SFdj5D<=9H+w85K^ z{eAOS7up-FO0uxJ807}5t;;7I6IR?e`B*`?KqnmUzRBo>zVYg%C5RWIvA}w33F?Qn zN>`jJEkVy{@Q$~pxbk0TDi+U{w;g)W8I+GgXA|7cB~qp|!dm315x$AkOKSw~DXI=v zoa9th?@LZY8SG4$nV=NT+NkZ1X zJi($&wv+^hl*y94B9|9I){Nfk&*f&$>!$5gE{I4*C*{seEHE=Xw8N9MGM6KA=DjcE z&aABKwAH`5wAS$|y32EC2B^><+KS4andO{$K2n1-MCVa>Wr$c5ukJofYvGfiP>;0$ zWJ*L^3r`?V-gq2oFq=1^hshhCQ}zAi4fHX*aZ?tZj84B2D@0y}F2WzrW#kI}T8`3J z>9r}Of6x_2KuQB&^6{+k9n9Mo2PE!amBV{VQ<+%`Xd5650ib2hwVX0X+mOdfQ~kv1aHam2=g>yu$M zEW6hsLcR@aZo4uJ|EGP%K=Y;XIG;111FN%$6k^|grPon}Px&fSRQnFkTcH`@@&{}K3+;>(tVW}Mwd zktlB=l8-(>Bp>-O82P9SDaU&qgHaZP)q9+d*%v1$R`ncfex#|rE*g&=t&FhEO84RU z`?_#_G!lz6#=QlNjp6!`R~2awMXMs=wzvdQ-*xtGHdFcT2RhDCvJ&5cH(plv*W4?# zj6aJw9UojxmigryfhGV&Poy~a0-GY`RnpXPU{r874kwB#S7tAhEo$dYRQv4^YA_UP z3GoH!Pih{p*-O{xa!dK6raI>4{WjSwjGC)-AJs+u=stGOnEXB$=VzjL(B7ZE3R#WW z5Q1>YM#FV2>Z9);J)Wb+n_-PtsSPzq=(41U>GG)f0@3=tVWXN=+^4J&ODh*8T) zkMrRPz?t5|i-uhTT|~*3gR{BD1C4xuk9ZS5t_gF5555bP>Jlqms5 zADaXl9@u|K|`r`QE3O0TdMuyyUA^;%X#98lNQe$4Iv2JNg+?yAQg`3)xVm1q! zy%p7-Fcp2=1W6f2=g7o}GhY>Hi^sehW1$8GC}^RoNCZ8VR}*So(oz=>^{OWUt6Rbi zA+Ls)-?1L7_q!gdXge(2dH-vl27UbUo_bGUWINYxKHlLp;iV8?>BL2edz79I$4h}L z;f0RkPrtMB-N}UH2S|Yf*CoRqwI57H99yojKpN z_~#LQyB70jrf$sRCu%c*ms~kqy)#?EMkk4%FjHXRLcVtE>!sV5)McgNCpw0x(=7$1 z2rnPcp0zhUs+G z-UyLnT($JP7+38cg%R>LE08M8Ttno}$hYiLZdUFC`i(qV-@rxJm4=6Y0VI9jr?83jAmu+{F3oqUbnUKNPyo~Q{5VLDJ-ZiB|LM!R~yY{MVB@Mwl z;JbG8F-n?e?H(nK^1hU4Vn?o7ntA7x|IXFCO(GWMl5du>oSH6sX1GT6vw~6-^{MN?#wE-krk3bUTR#D+;t5VTk5iuXa^y$At_01X(6HO5=A5# zJM;5YM2putloL@Tfr!ya$G`%W4iO%zOP45ed%xLrY%zuzzVH3s`@BED$$n6>E6Nj< z2S)&G6bgkaw$5KMeYj*w*M`}1$Wn)V>FjYMB`&GA_|G-_m-F7jHWGJqVTLel)CMZ|hYry!{+wM}Jss>@SpS7o&Q z6rI;(Im!tej3JIW?g8boJXk^5K}M?;ZMtkHPc3wmw=k-27QW}HIae*|lJ`|_EK)@@ zOp$h5_~gObuFF&tl{hhawm&^Gc=5vUO;lrfUgQ(Kz8eZ~+WwuWt7o(J?lb*6#Pjn< zBk|^@cvI|1;&80Br8VB1h^Escc4la%YR@#G7Ow-1CJ=iFtUd-_z5v?iMZxK|C&xl8 zU@%TI8O(k#K2XJ`ZU5A__^|-5Mvjsz&>)wJPF4l!BhEIT^&g+GKQG)@cm1J3rr^UV zOi~czezN>XiaT!~O~^A@B8eU$YY|@*}Jn3edwlFJ{`OU x&-~ZG#DEhG%lo12(an(ZiN!As!f_7N^ezBb-vQs>1MyWLvt}2ZA9XY9>R;1}+Xest delta 566 zcmZp;!`yI#c>@a*XE6fycz&LpUj|dkB z!vsd4Z6NLg9+Al}xOst!KrAjE7)uAv@`JMqz^pnRMWE^hJRs|UdiZo085ztN_AtQ> z1WAJ=?l7Q8)bU76w&4XiX93U&cBoFM;DuQ{3(ndDW}V^%nfHcQ7h>vUJwBky%{F{K zS`rLJKsy<@7+fooQwvHm^Ye;Z83Y(k?w`ECB8;_wnSmj2^KT1T1;&)kl98#xo6qDd z;+L8L)KT8Vz;GYPcs`GTp??hnL-q~^2J`)sdCvrFzEQ)?$PvK=3>k(9rp>QwGx!-N zY!2ytYqojfkscP_eL&lK8CV&78Jrl{CYzjGZGD|Vg`tIwfkB5ciouG(gTaL%3IhfJ zMeLY_7`Cug0d02xVg`mL2B*mjUx-egdYYfRA1uPi(9h66`N9j0$=6S-2zeZ2V8}Sd d!0_M_1B1qG28Mz=n|aTCmYr