From 9c2f487c98a36b9b7036bd64a4576bd5a3085336 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Fri, 16 Jan 2026 07:53:47 +0100 Subject: [PATCH] Bug 69927: Avoid NPE when parsing wmf-file headerBitCount can be null if the header contains an invalid flag --- .../apache/poi/hwmf/record/HwmfBitmapDib.java | 7 ++++++- .../org/apache/poi/hwmf/TestHwmfParsing.java | 3 ++- test-data/slideshow/file-45.wmf | Bin 0 -> 24890 bytes 3 files changed, 8 insertions(+), 2 deletions(-) create mode 100644 test-data/slideshow/file-45.wmf diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java index b6c59a2dfe..bb2e66bfa2 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java @@ -243,7 +243,8 @@ public class HwmfBitmapDib implements GenericRecord { // The size and format of this data is determined by information in the DIBHeaderInfo field. If // it is a BitmapCoreHeader, the size in bytes MUST be calculated as follows: - int bodySize = ((((headerWidth * headerPlanes * headerBitCount.flag + 31) & ~31) / 8) * Math.abs(headerHeight)); + int bodySize = ((((headerWidth * headerPlanes * + (headerBitCount == null ? 0 : headerBitCount.flag) + 31) & ~31) / 8) * Math.abs(headerHeight)); // This formula SHOULD also be used to calculate the size of aData when DIBHeaderInfo is a // BitmapInfoHeader Object, using values from that object, but only if its Compression value is @@ -348,6 +349,10 @@ public class HwmfBitmapDib implements GenericRecord { } protected int readColors(LittleEndianInputStream leis) throws IOException { + if (headerBitCount == null) { + return 0; + } + switch (headerBitCount) { default: case BI_BITCOUNT_0: diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java b/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java index dff936b099..3f8e270896 100644 --- a/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java +++ b/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java @@ -54,7 +54,8 @@ public class TestHwmfParsing { @CsvSource({ "santa.wmf, 581", /* Bug 65063 */ - "empty-polygon-close.wmf, 272" + "empty-polygon-close.wmf, 272", + "file-45.wmf, 1315" }) void parse(String file, int recordCnt) throws IOException { try (InputStream fis = samples.openResourceAsStream(file)) { diff --git a/test-data/slideshow/file-45.wmf b/test-data/slideshow/file-45.wmf new file mode 100644 index 0000000000000000000000000000000000000000..629358801701ba25cd4c730d495d351961ee6b18 GIT binary patch literal 24890 zcmd5_3w#vS)j#KM0!iehEFh>DL6oAwH$IBckkEn>k|rUbqBSH@;3JPF;niBC7HtLb zfp3czQCn*T1ZiuF3iPYC+WMdcgMwAm7Hh4>THAuK^Zn19xjVbb&az)u7lz;LoO|b< zbN}aY&%JYJv$VbN>^(%E&@ehHRBpzR9J{KRa*0CAP9^F>=XRC4ESw?Ep=?|aGsD0k zR5vr!e90UQ>Qj@CPdRR8y%JT4(k zy5n>m<~YCnq2s&`5c_T?`rBs5nfEZ!=7mgVX~fyJhUu?;nf6v0I(tLJS-fk%({Bk= z)%u82@b`$*^*BQV%OcLGb&m6e3z*(LoM_VO{Z1idzxNx*DSVU2{EF$>V;yJAt4#OY zE~HYId3@5_75Cq#MO>7_BNs)pB-@? z9ZPiIbI|jPOkKZB^yo;(Iqe^gGXQ|W#2I`o z(cK?KoO8bGI2V1$G+{PT+t!FPY_Q`j?&>)0zjB;U?v6O)RyxkT6NqXX8mIjMmOqSo z5hIp*k?G!@4hMY%^}}b5ONVIy=zi1(l^tQ=+|`5aZBWW9)&)oO?P|}^}uIu zItritU4$XGjiF;uQ{UQJeWa_Id8<3*_r%#7XMdbWk(o2Cetye5+~?91Peebly z8|KfFyLr&N7i`-HIwKpzAG@MSs=stta zq7hU;=TPOu@lCf0K8iTwC&QBY1y|Eh^_PvW%{BxxvBO?U4 zO!p3ATJz6A^rN%p!73`5=og!a{ygkDdh$Q#!tx?n#?a!Ah@L-T0nOX96n2%?64lo| zO0?msB{bxY1+G;^W5?Nq)L8fJ0;*ha73?q84x#?WBBnbos-ugBcX3B>2=^RkSRbb1 z5x3KCr_Dhmi7or0?dyLgdiNVk=$pc{iKGD!c zWwf+n75ptDxH}{~-$r!t8)Inwu^&6xsF$(Lv~vT|BmcXcPR*W)$P~#v(RR-`raODj zrLX;ErJD_MaEIxbpI|P!;95Gm@#~0i$sU5C*Ih&}Ty`Nf*Uvy)Ydz79bC|kqYoHs? zALnL+FzzsI+XxAx=F(+9{5D32NRZk`w-UWpF_oq^R$&-uL=cU98uRA(Mq2k#1BQmw z9*wqn$g>l(Z=|!1%&)uze`Uu~5e zUj@n;t@GV_u()hUMIKw+-NVo*MjsgxF-6xtcIXblJ!YzMQF&xkoR`4P%o`B9_C=!Mh()?(x zE@^tgm7Mrv)2HkA-u;#LHa@a`<&QqD-n{YRGe@5E&W2sc7J6Jaw(oaV%nlY=f0z*=Kelq;{XsHn_q*IK9)Hsm@|-Gnh7MWvSNR#ax&eR*df&NfvFyGGfFNWwWMDI7Vu`G1N&jS=v%n zaY@vEO7UA|kd=jdli|OzisC5UT0FN3Qy~uNgQZ(qjk6ogs!_e$paVUOV(utGI!H z+qRcP7*u9@HkgDy9>E!O)&8^HRr~RwY+B7&QF1+P;_GPxFLBG-#-dTnv~%`n;GrN? zw%($XHQIojCR)P{w3b_FJrJ(;Jk=SOcq(j`0KZVZO=GmJ!HOEsJ%N&xvmO>u&g)?Z zr9_&d`TQd?+l$Db(=NUiIw!ZkM%0m6iCd?GRwmSBr}d8HRf(NH@p5{d@1#*?5sfz2 zyXEBAGl5QH=lk>q-{m5Do9_V1AY2*&*8{)$eK~lvt&N=^Ny>RAWGm+)*g+|grZO_2 zul2@D{19#7`;md3q6lv$DJR!@CB5une*mo&`-5Ix*ldOrt$WD38#c)~?nnR1@f1)f zWu@ery?ggYGpW!v7iwOSj2k;sNQ+qX?U+f@w7hNyj-SjB8)zgir5;{9*!<^b ze$g;^hVb)dtX^R8^z!xAUhTM!@Ab3L+Gf|FtF^O@q*M5DI-MV*3VxMJc_&HPT1Kxv zcCkU&tfkXD&#$FZJ!+jth0RV#(P(%avQpuA4E-y|t3aWYl@c6DzGq@B?njdE5!E7{ z(FwJa9@b78NmJ-~ywO-57tyjdl2$UaiiW|F&i4pl5(C7`N}yOc2G*Bsf3~cY=a$?5^3p2-~VqUucURRi53RxX?4<(oVax+NAjcQ7FuPNQk%Jl zUNQHPln<5Ixdmu$0J>%L7_N4O)OnSm5pW;ytKWss+F3_(kR;_?iawO{9@s%Ck(TM$ z`93w688kA**h$ue&^on9^7ro_ zH>3D*Q^Zs7lr#lTNm5pf7EMR&>G&j7bh^45&Fjnv_PhaVQ#D zJL{YfBuP0%zH*8UloDy_$6%`Z+Hw7YnaEqrg?KVtj3@1-Eaf0?DE0~bvWIvAzvxjV z9u+oAAw~6>2wACcT!{XaV=+)DB~sG2MQY>GzRL*l9Nt33f!bUD>e?!C>r6zd_1qkO zpXTsxynT^V==Z%G);V6&w`HnvrQ=AE&Ea6*|%?BbcPn%&d~mh7dw+li&*>ld&TK^HMNXj_aDp6Omn;m zUNMWV!85c!i^b~Y&(OZ!*2bDy;(N90f^@XDd)+}-YiFBTrkWGYWHZFnnEgE6L|Dq& z#-iznJrn3OvkWnpz$a783Fd2NAW#P3(uj-zzeePVW~$fLuDpXJDd!N#R?hug<55;x zuGznTe>9ebwy~^ZU1BxX=h7k;r>sV`oQ~a6i)A~z5%1(bM89RwIVXv(!LjW7J6110 zmVLcdFT2`|@Ab3LI<B<1`UETEkI*uEhbX_<;an@=6S*1W(K-dO0Y zXMF4=Zk-A5*gRNcUgOKn>wL0V#iy7bBM-cG03YpS`&7G=r+Haphew4W;S{g#H7}>& zO>u819LHASX6R6VzeH#|gC$3tgEs3UhTa3`Ny)qU-B)yd0c2d z#@~GQ=Tg&$rK}h&nvU2rflghXL&JSokzQMHe0N&UQ9n_|x zg^ha6EJ2dg8*ib#a*7?S45e~S_x4D1Z7j6SEIQwJ{MMYbh>eEP@-y(x#z0&ek%C|2Q24B!HI{=UDW_OKIq!!ZETz(NO(f#Svd}h`6VE2nBG!Hf z<2i2$59UkxlfaxL8V1L*@9)I1?CWi9tg#&5t4hhlUj_KjdHFn@2XZZ+%cVS$%UQ~b z(W3FOtLMwnPW?R{t(B^U45dmTNhxWklG2HOm_6xX<3{ayG0+d?5rG=STR(B@bkL^y z9BXIAIxgfoKA)HJIXKS;U3dWOnLwwRM3L3;7@i4F)&}AdZ-?>LXQ}6R;j?zuOcEr? za@KjAVgrpGD@}Hc{J+W(+Gdi(vxl_MzWouY<#gx}`>w=cYrXI`ZqW;;n)Q5<}4WV4{@2Xsf9{dB|uys;hl)uvs* zr#e_~1WB^q(6P}QHpug2h_uXm<0C$s+c6XToWF>31WWl)@y0nWvUVN?R3rGWfwk=dm~7aa*jkl$|*KbN~C4p8~gBH(&5Ya6}|>*{RJ%LL&Y0Yf#z%2F|Pr_ zOZeY`xYVW#fL|?n3Hai@5hO`DFN1vLyaskqN~C4p8-q*@pNR7Wa|;i0&zb{hU5mDg zxQ2&#R4pIxQejtuy*tROOU@zvE5|KS$$};GwkR}JT#Rp@&or%krJ2W44vI`c95$6) zaWbww<*+4dT0;! z{m(9Z1NCwGlIP3B&t<_YN`J)|s~5VDljrYD+jo%hz1nqb=GM^>>Kpn!_Q|X*^y+&_ z%NA|N*5dVCgWn2>?x_jwuhoUS6r*oSzHjxmqYhe=0Fu&;gVB=&X37`E1n z@6|@w=kIG9;p=!DV-Bg2PSi!9F#Y@e@3V7kgH;*~Z5s8V1L`Z|%f!@9P~ON%6hfUjhlr8a|rXUVQ8M zC^BU|JANMG9Xyv;C5^#g>-pA+)e8oX8;_l5i1=Qu&(evR)W)H|6TcceMyvT2#LY6C zH-cUo7(wa#Bvo|!ynZA6aWl@_fNC*67>G+Vz>R35qgXVuQL6iAL6Vg77PMDRv4K)n zTCVB&k-rl!v_I~okB&2-w9vl&m`LAl=qTx-J=kwtE$1b?h+8}x=$PubzY!eEiN`3q z_w?#GM(qq3->dyQ{h&yYHu^Q{xBmv22^ z?|AFQ_o`CTdkd6mrm{P2*O*)J9kZMGVe?ad&^*CXR*V)+N9>u%@|s6)SA*}d6~kUyF;6#;ez9B%Nc