From befc941dcf7ab1a3537d9bfad0abd6a6284fbb2b Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 7 Jan 2026 19:32:26 +0100 Subject: [PATCH] Avoid NPE with broken files when handling paint-style for fill --- .../apache/poi/hslf/usermodel/HSLFFill.java | 7 ++++++- ...00a8d44da546f97ab7795c500a58bed6cb655d.ppt | Bin 0 -> 9728 bytes test-data/spreadsheet/stress.xls | Bin 73728 -> 73728 bytes 3 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 test-data/slideshow/2100a8d44da546f97ab7795c500a58bed6cb655d.ppt diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFFill.java b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFFill.java index 3a8c767e6d..9847155d50 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFFill.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFFill.java @@ -244,7 +244,12 @@ public final class HSLFFill { if (!FILL_USE_FILLED.isSet(propVal) && masterProp != null) { int masterId = masterProp.getPropertyValue(); - HSLFShape o = shape.getSheet().getMasterSheet().getShapes().stream().filter(s -> s.getShapeId() == masterId).findFirst().orElse(null); + HSLFMasterSheet masterSheet = shape.getSheet().getMasterSheet(); + if (masterSheet == null) { + return null; + } + + HSLFShape o = masterSheet.getShapes().stream().filter(s -> s.getShapeId() == masterId).findFirst().orElse(null); return o != null ? o.getFillStyle().getPaint() : null; } diff --git a/test-data/slideshow/2100a8d44da546f97ab7795c500a58bed6cb655d.ppt b/test-data/slideshow/2100a8d44da546f97ab7795c500a58bed6cb655d.ppt new file mode 100644 index 0000000000000000000000000000000000000000..56815d6accd8526e99ee8bc97992c742df4fd0ff GIT binary patch literal 9728 zcmeHM4RBml6+Z91O|xl|zHNS>E!aM4m7;BljRT$031M1m6`5v8@Q10en`AfH=_cFR z-C8>6u!tf;(Lk|Gkm(P_nS!Eq{6!F$v52EV3Q~t^2kL-h`BAor1zOtm`_A2$Y_=QR zC>EIMP0qXL-JkP!&pr3NySpEqzJJ>fXZ=M=N}D)xEMFs2irOvU1T7(vS|EHsme1!+ zqX^KGx@lCrc7EvYOa? zwbbTX&~_C)DtI-!gV&sor#xVV5N#i{&=h<~Tk=*A@!7ILCm51h2gx|!3fW}#LAo|6 za5Vd0#kQOyIrnsul7Bi)T2q42k|pNK?&?-dnj=jCGqyRvvA@{3^N{@Z){op>ee=Vt zDTXVDojy*IV~!dCZF1E4FrLc*y+t)p8Tn*Rnr<;m%XgMr;jb^_OtGX<*2ocu%geF` zi2qKi?Z`9cNMqom+G}`_elfIz_O{h^Ep(#}xRDMmeprp5kyq8Bcz`bJ7aGEqYa5qn zeO)7$07|eMY4Hlr2rven3^q$t7HE4$W_o7CAl|#t6G3oX4TmuFxJ5;FxEGOLe?0Bs zKhq!e(rddj@k}DRz>5!h-N{66z4ms;GaS*KSR3^sgS}on6G_B-#`UG5z25x6WNILi zI7?)k%MI2^CR%3WX(`Z2Y`B`bQq@fD4bTmbi9D|+aOE}U4*0t*FF7;(d3H7TW>KkY z2}`cpLknC&+q2oM*7xpzMp|2kMTUoEcm&(6WZb4rn{?cfr#mG-9Fq}j0aVA0^XUzb zM{ldz}Z>haiPzmuV%FH3gw4#|(i z34oWbjl1 zgSRVpgNMr;DIMU-{ms2@Y3f8GEY|2d^`QoSzmdTieGkKeJQ)0bqfZ!=DV0x;W7eRJ zt3__6&`$mc+DO$y7ww~D6>k7_e|&>v%TSq7M5U>SN<$HqP!W|7B6D5fk09%co%=oN zkOXs#9*m+>wB5b8 zvr~ZjnmGl{{Pe=t?DSo^ajC|C(kbUqr$)C_CvvsrJexXgR+-GXWTY|YQhA-CmuHMh z>H5xSPZEbwBKn1Bf@e|6$CoG9rZWA7j^*)~kJAd=ZD%M)ewJE7KemOqqc{~e*5T=8 z4w;pkQYH}W5z zP=4-U?z&Rn?AkY3`MprM`FQzBKKNhAZ;zAz$#L?p08QWi`t1j|^X0#aPKMMS5hl3N z`o@;)gk4k9yCcULq5xF zZ5gu481l!p$RhdC&-XO)%|3kOy7CWa9vslm)i7K%2__28&G?N zh)iE$67PzWo2UI1Mr6$KBXSBfeB0V+_aILvA~JXSm4E=m82NJ!_N0%|p0J{$vAYm? z+p2b2yPNg}OZOorL$WrFQhEx@=5ec9%$Zu0%5=ouPQ`XXNB77%dqt#ABgZ#^UW!~>iGmU>?A~XU4FTOc;=7xwy+J(;s5Rv#ye;B1L!+L0Q$@w0Q!wdR77?Grw<(f(1%_D z(2p1u_&Y)!YWflH6G`t`5TlQH0RKWGVlrUdWn^x`4F@hX5|N(OW*lj*NcOFZq%vus zI=5UKWn5h7r!QU@?@1-o$yml)8H>exqFzUGT{P8^j1Oj{9sMoS?j4{!ir?0=hleR~ z{~nurhCcprz%FbYE*IN^^7T+31mI_ZID0{&N^mcMLJ1ticBW5zk$D8whF|*Gr+SsYXifMs`jYcg$?Sk)`Hfa)FIcKqB`ft-?Ot5r+H+K+uq;IKI$k4Q z57T=nSE&|bI-F>E8Dkbt4a+4OE&c0jU!Ex{E8oh?#kh@V%w?QZd9(A=-t)+w+ZLS` z+IS1j&jqi4pTzHj%h8_nylVmEI|Sf4xC21>?gKCf+XY}AHUeNYe*(Y=vk$=Y^jQG& ztQP@1lX-1ph=z0sY7cli^d{r6B%z= zG#&37)P&Iw7ZW4{b)Z8Ul$|`5CkHcW@8Wc{cT`k%QC&mS>xvGnNklTyas4z^XCmGk z^}6`;NqV#s?Pba#y|iQQd)b3GKC=?kgYpV~6Z=z(pObLyR^WH!KK#uxwv6Q-ip%*4wm;CdkEO6@w7s_drl6TIXT)hQD}`f`+N$n! zUlC(n_qR4Rcir3Gy<%lSetxjHsj#pq=qW6^$L9@(yk4KD(Sz7i9BOVVY77;5JWV%t zbnJ|r4&|Cm7lVu)icGiE!^6g!bRlMYn2iA*IgZ$DUjm<`e$D&zb3Nv0GJ8xnp zW_&PXp)Y|YupD>nJiZLbu|#KPNEW%snby7gOcp~5YlxIz*kxHWgU_G=7)xipxJDUm&Tt#>M(H_e?Ils0C*7;E2|V>rw3>t}kh0xE|9k;TqAF&AQ>ZR)XsZ zt$x;>bsRee@nx9taV^C|kvA@0fQ$8OPs(&3t^?ZGqI9AzZI$VlHJB6KS-8HU`Q~EX zNxHO6reD=MWqLoZuW8ROO51g5@!(zTq&6A`R{;GKlqa2*Oi zz9{X`rBh{kI6NZL=W!hgPc2G2b?G#jeuEbPcujALM}OD=2Hpm+9Nyw#fIN7ckKmT} z4!tj#@_l&(uN!1fDUb=He2IdwcX>boFO2a$Vmrl82>2c!7u#uWH{tgFfX@WI2Kaza zm~s4&J1n?;#7iuA#m9V?*v{}iv3k^KybMgvfvyKSn;~^yc0L|8;Y!;NUs%g{ofMIk3yUV@mraX-$L;* zn*Sgb$cOeFWecc4O+xWF!IcF40)9{MCW0*p{XY;aj6$4*sxVIFk*Xgl>!E@n(K!X5pEKq+Xcr(ER0{%wOPjFPICJC<6saD0Q zN~G#{%9c<;wjEplAh?=fg@At&yd??;y6te#;J-k$ROc#Sr{fpqO z1RoOcZ-Q$GK8w)*55aPssyt2=kg9(v8=!(Y(RzvCZ3Oci2rm;{OK=N9{}qDkbgFf6 zs`XNJm9p!p;D~6QB6vH&vjR>NtRQGkMb$Nel{!^roT^Hy{-bOa6>P@>b%x*_1fLLa zmf!}0141=NaHCGOF-}!2RS4zpbu|^JPHY8&H3aLc=U1_K?6Rgvz>f%)OQe~lRJr%TLftpD0E`kRHv=VF}I4V?0 z1h?u`TjNyQq{>FwZB&q*j;(frcN44-Fqzs(5ZIBse)3KLfPQFDg#>` z1Vi&G0aFP!&Z{!ua(^cHj5ho^EyXf6dGgT&UhM`auXBUVQZsq@F=Nj;(3UA_13hlo N4KOk=bsdzvNlIgl66^Ke-AJlxRJ`@g^QJLmR7 zIxuDoj2R=hyZzbS41b)gy07Qf9XosP+J5&S^RX1`e)q#>Mp{e9kDv_^=a$Dg<#Gz)M1w$Yq3-G+nEjf zqt@g?0G_o@F9b@X$i?tVB1>S|co>p%An#|-k;9=l9OMWs2H>#Ou^4wGDGsr%pN*2k zsW_bE7(vJL*7yYum*Q|s#|z{T&&1D`@5R037`g-kaAc?);(H`34v%!aNDhzU@Q`CS zI$jzYzQEyC96srInH)aF;ahU-0d&OpN-XC;)D%UMDkVorlB!5jmn3|Lu#EACu;eU1 znl#0dE-kO{V*n-Qt3tNNfXm@EzRG|g9OKPc(qE?`S#rn&*b-w;*ub{J&9ZQkc+ks_ zdWH18!G}frn|#WE5_pUIOe}Bn8WY2J_)byY<@-b#A00R0pbg&ReGWXG;QK{+pHDil zW0E_PuzbKnqI}5vlJMF`e7`8i`J^Zx^EpvI;j5fjKIP3=yi>GqQ11H~f5Ztn-p?t# zg2E#h!WVo>^qt^_3;Vt#3woqeNOZFtO zt7+JT3zz(w!Zj4mVi@^`!Xm|5q*;rl^;=?#6}DJo#UH(&eMjtC8n(-g8+=b;355qR zjQl|1I>ow9vzAKhkHnTLY^lbUN%kjV%V=1BGH&oQg;!A+#xQbb^%T}&7+Iijvtr$>SsSHwk=RCsZPeH%$zmwKEt_cAgxCNmyn(`5 zv4M@kX2sg9SzDwvf!G#>ZPD0P$r{AA(y(3WxPeLGjT9chFk+{$O|iCV)^=%4B(_~) z+ch>USqHIU8kV1d8zfP96NO<6BTfoC6l;fO?UYs*v7HLrsj*um>n3&!4VxAlBvW`Z zh0aX4Gvc9et76@%S-YgwOKg|Ic4=(4WPQYTFK>{E8>CR!v%G;H&RV;TBKi#;&Vtee vcL8G|bg))iznwP*AdR;L!0kAGG