From e9e9612a1f19a0e88e68ece7b3b0527954a887d9 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Thu, 19 Feb 2026 21:56:06 +0100 Subject: [PATCH] Avoid ClassCastException when reading headers of EMF files --- .../poi/hemf/usermodel/HemfPicture.java | 2 ++ .../VHZ2NYFUYUUJNGLABL26ORTQZA76FJEW.emf | Bin 0 -> 135092 bytes test-data/spreadsheet/stress.xls | Bin 80384 -> 80384 bytes 3 files changed, 2 insertions(+) create mode 100755 test-data/slideshow/VHZ2NYFUYUUJNGLABL26ORTQZA76FJEW.emf diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hemf/usermodel/HemfPicture.java b/poi-scratchpad/src/main/java/org/apache/poi/hemf/usermodel/HemfPicture.java index ffd51c65c4..95d73082b8 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hemf/usermodel/HemfPicture.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hemf/usermodel/HemfPicture.java @@ -81,6 +81,8 @@ public class HemfPicture implements Iterable, GenericRecord { List r = getRecords(); if (r.isEmpty()) { throw new RecordFormatException("No records could be parsed - your .emf file is invalid"); + } else if (!(r.get(0) instanceof HemfHeader)) { + throw new RecordFormatException("Could not convert object of type " + r.get(0).getClass() + " + - your .emf file is invalid"); } else { return (HemfHeader)r.get(0); } diff --git a/test-data/slideshow/VHZ2NYFUYUUJNGLABL26ORTQZA76FJEW.emf b/test-data/slideshow/VHZ2NYFUYUUJNGLABL26ORTQZA76FJEW.emf new file mode 100755 index 0000000000000000000000000000000000000000..6dac267f33f121d56dd803d15b73a1d372660f0e GIT binary patch literal 135092 zcmeI4zpG_=R>ki$iXww!prVPEnTW_B114H!4?SgL&<u`{Mb(|AB!%>pXIp8b8jhncP*sd;Y)|Z^Ei&dJ4bR& z@L>h4fEBO;R=^5a0V`ky8Usv%_R`-=X9&00` zw=?T+!}d+?(dTG-@MWH z-yoxYzHa7cPMF`HV*6T6-r`U7io3B=JypAS|AR%VZ!MYM7q@lx-S+17Goy}f?M*Q8 zS#!i|o^V^uEjP*v6uGClzD}L`+U)W+MyD!NVCbQ~yB+5%J^X9e6%sir5Zg6>I~ZnLkLnk{ZCYl~N1o|zeu-ZV1$TiDaw zcIUQsmbaJ74WgpQ>XUp#iOFbDc7l(mv3kzqdp(3 z_t3+ zpR+kL?_*DG-|~s{uF0rZ)CaF#J(stAH1^YP7B`xaS?9Q{m_^YiZ))G#nT&Wc1DvRK zg3sHC_~fa1#4UGBd6}i#o{b*$GrNc#8Ff=eoU^<(V{hK9Q*x)H+-=NDCbQ~>^*(vA zI%{omvvU1nsIxqaSziZ-oN)J+xr+&wc?8+~iX+O54+R_;QS>`kKF<0jRv zu>w}W3RnRvUDzYVDU^L?QD2!k+$7o)$!+zdCLS@_ z5kA?`{mksMDpuTfQ)ivZ+H=Of@frCe1D|YmO)e)VmwB^y%RJSNOmqmocGEU3CqzDR zTNg-o%I!DH`}5JPV{q9$_t0C$-Bw;(sp`{g?OfxrYGls8Wz<}gCnvH;RXy2R)KAYh z$n4}Yo7=e-J>TL)8EM;|0mq{ag!{?x%HeFQbkk>@;PY<5oEpukF_(^Ta2U(X2ji zuZc93Gy04S{ER)#)vd^^IODvTMdZQrWR2LCF-iqOF?}Zg!xL$@-q$@FM(v(V=U4$N zU=(?qr82i~ zl<_*xAExc*yIjInC0~4h`F}F~xc~n!RJZ)oI?t<}_QcsYJ4c;v5|L3^Vm&!aO!iAA zx%{S*+d3n%FYVWM$$qyT#dbN3{w<1$``B6Ki;s^zkDt+NHgoAe#m>m6c-XU0LC}QGXx%jCCVVB~NsHc|Y-0S;{$9O!DgezWBJn zxL%hDQ{RJZao;?MD_{kz zfEBO;R=^5a0V`kytbi4;0;d(2{hfBko$jJrDtUzGXJnkun^#}Lwli83eP+ANxJ#y< z&t*bttjfZZujyruWmr)O?#_bU*GnxS$Q-6j&yvFS>B9`%65|$)r|Hg zP|J;*T*t(lGoxq_urS(joJCbuj`w?*m*cvL@O$dpob1-~J$A7pEDelk=OUr-Q{O=3MHai45**eV`Yr|rJLk?XXT8`+pVa+OXiFlMxH*Ex$U7c z;+*BpI91j8HP-#!Q~TB)BbQ7>+ufrNpXx|O{FWt`^~w@cE5&V}QC&Zk8&id1e(c^) z%$#|os=ltrbw+kN_e`7LqwU_k|LIQO z<2+7{+U;6IpUA8oxBnepvzE%qejsh3?YjhNck%(y;h zj`a@n+sckp>+RbZhwAz~t$@`#t&eZ5fEBO;R=^5a0V`kytbi4;0#?8ZSb25N~MO{=}`k7ra+UgM*=kxmdtjMU(0qa)hEGP0JLt1QcTlJ^-*?%LM?M`jCxI2{*`PwcsiLyHRwm(RBI>!t#y;7;wc%zzq z=U)F~;+|(6XT-9$+JK=o4Hvcrz?9*A-+~&JxbWK0kzG({F{qNYDrik~o0#?8Z zSOF_w1+0J-umV=V3Rrs;NX_p=E-C#;hh#QQXg%(_=7P`hQXv1gm7 z*|nei8#CLiKx5VxGxD>3;>OK&)1Uh?WBO$~^ph$M)hiRK_Y>|qFW$b@phem-Hi^&I z&1wGjIe&*){@%>n{0(STjICmicALBBazg&*wL3_&8G8*!-)rl&+f7gA>p9)yw%zZi zu|;sNJ_-fuM%qCqcac?@>p1nSb1&igy1T@;>3;pKPc>8BSI^arq@wl_p5Ro70K@2eV}`n`!B z$*O1HrOilZdcLn4`-NBWsqB1%jN)$AzvqN?YG&U{)7q1&TG`$vYBx?kqPT5yG+*bI z=2@FvZ<~vEtnaC_fsiRsgS8IsdTM$p> z#q?ZsitM)2?QrTJr%>#6m%C)|%ilw_S((b*9v4&Eeszu%tG^54`m^sMtTW$8QBJzs zD7rH>cV?@=I&Xg~y;V-wp3(23%v$^EIHvMQFU85|CQs#v30zsloa*!{B6N$bbV^Cs zyW2oBb81XuB2V0FgO;nT@?HfOd)4joEpp@BsNS}35UAE<*Nmzn*;TcDb?}$xWkp7} zJ!967Y4GjTL=m+ac^iCtd-og@^yDtQM@5d`E(PrV+vT_4)(ThwD_{kzfEBO;R=^5a z0V}Yjz}DXndp^EdXuFWp=gk#lCp{J2>jGH*eq6{aL*CxXoC#hyw|ltA=`%-mWKy-N+ckOpJLz5Nd0R80Q`;}+%r>}=8z)J(w(s6N?b=q~yyskx zksTS$Y&X9qFW#+vvupb8t&NHGH>};^I>Z)z?`t^e-flI{*qgVtOJBd0cf0S_zg288 zn=#w(rW|$cWTUr9f!Uv)x9R=;u2#SbSOF_w1+0J-umV=V3RnRvU{u z(TYD>@#7W$(~6(2_>&bsTk*fG_|p~t=ZgPp#hHc z6|?&zG+utt{NC~d#t-n*6%+G=AKc>y_}+4Y@dJz>VEh2%2N*xV_yNWbFn)mX1B@SF z`~c$z7(c-H0mct7et_`VEh2%2N*xV_yNWbFn)mX1I+WBbNTtz<=yTrC-}*VpRSl(?z!U!KaTk;haX`4 z;2uA~_yNWb@Z%NZ2N*xN#}6=mfbj#2A7K0d;|KV&72^jOKe)#aFn)mX1B@SF`~c$z z7(c-H0mct7et_`N zpR5=^!1%#EwP5@><}W80Kfv#=n3x~@;Qpf(KVC6@aE~9{;|KWJitz*d>5B0Kj34BG zwqpDM;|KTn0mct7et_`VEh2%2N*xVJZOd=-(61p0OJQ3Kfw3_#t$%l9P^hGj340lS4?j(cl>;`V*CK( z2lw~^{$$0^R*WCqf4XA)0OJSw_yK;tV*CIf|9Q2X_yIot^J+Qq1AP4F)pFto7(eKT zA7K0d;|CZ&!1w{i4={d!@dJz>VEh2%2N*xV_yNWbFn)mX1B@SFp6_ukI)Ad9_yNWb zFn)mX1B@SF{5a+>Cm27#_yNWb@S_#u2N*xN#}6=mfQk9R4={d!@dJz>VEh2%2l)Al z@dJz>+~WrrKfw3_#t$%lfbj#2A7K0d;|CZ&!1w{i4={d!@dJz>VEh2%2N*xV_yNWb zFn)mX1B@SF9yGv@e_u}g0OJQ3Kfw3_#t$%l9P^hGj2~e90OJSv(Tec{j33;fj{2S3300mct7et_`<{Cvgu0mcvR@dJz>VEh2%2N*xV_yNWbFn)mX1B@SF`~c$z z7(c-H0mct7et_`VEh2%2N*xV_yNWbFn)mX1B@SF`~c$z7(c-H0p{VI@Z(1p z4nM&70mct7et_`0K zNH~evJ{Zl6x(~~UG#Xvv2a}mBWPbB9H^tkW;HEHjxT()MeSn;oCOn+~`#ZnqIWO-^ znA=d#ZK$taGsKQf5ctxQ`q|;pY5&;N!FVJzM2wOLvww%eRSeP79q7$r^iQZ zlT&`%@YLk9qo@3~spBU{hoPLX`JbO2wGEFC&CD!*G7+lTeSsVeCBy*3oQ9q0DTG|| z5Rx57$dzM+n5~3ZVAO8S;=@xtG;+B;n$JyMfE^S*>+`+-l$zzRom5TKWI1zZtsxq+ zJR7sUOG~t5J$~mpG^gu}ANbc^xvZipcA3(?B{j8Z=BMwf>A8R=jJ_RK`xNffIZ8-0 z`2xNNR}@xoqj05y)yLb{)UbMa`X^Gq08A(Qnu+FL&5myxe8Cc=?t+f#UuS z_i4pG7Y?N*DzL1;wd-&+EeRp<@KKAyz#V~W-?PCunm||B87S@_(4vzpI?1AwEMda( zBfAx}ta8gwXwgd+y=2i#mR-W~GxNlYS^A;4@1cc10kLH3L_uMwW*_nJ zF}ughCbJ|%`6u8>rthif6SiuD7Ds5cvfAB(_Y!mJ8O3Y&kYt<`cwWSb^atpCBH?O37NOuvQ6c0_1)GL!JvK|ug|X5xY{0M?LSF`kjgqxdVQmuDOk|rRwn@S67i<=?`?1+F zpCB8 zVQmxEJ;=66Y@32@7pxuGc5G(PhY1QWJcMB%guX%y4@=g=3Tub379raqu^kGwQ?L$X zJF(dvK0z^tT^Q>3zyy0S?3S$E3TuzBI+5*>*d7JjD_9q@z1ZwLG&92Ab@5+7ABG?D z2}&_MB3X|pto_33Mz&vK`xWefV9Sslz-Co;n4lcPqZpp#VFiZAFkGS2 z(@XB@CHL76ed+dL!9Ve$ee%GQN1i$K^u*DZgkNMF|IGKQ#~&v|>+IgdCq^xoXEu8x z)>HhN7>O0a$1TN0LR`!fqNGiT*$g4x92SDogn0icA#S>7JC6>~^YeWhm0di?9mKC? z|JvCSmY9xTJG+ES%zM|)Zs8X5g==Sz@QC?I9spmAh!M+KYwz<~v>Y2f3oA)sv-!_n zer3i@L+@B*MTXpz>WRGIrPsZY(G&_0x#Y(o%1W9d55pv;h=21$K1ij5lsvy~HGZ3x zBY`w}+p@nPA@1<~QVr?iOL;MaN@!swlgj8T8B}Fa4yf|Ad{LE4@~kSCRzGL%KxbX9h7xo3$pEM9H-78b8z@xpRS zS-z8>thdA)mIQ729+m{dk^qZ8n=L=cAeVc)_zX*;w)_Z7qG3sdWm;K&k|)+%k_?Nj zEkDCz8x|XuTgq}x`f}Fo;x{bG+VTr5$%Z8vmQik}>vC$nWrJZ!(Uu#qq!^YISmu@G zS9v{$>gc8n^XawVTT?#NI9)mf_~4;4_@`j6!40xBgT&lfO6azzzO1~zeV z$zE05a*E5K$BI5%W%?>&_%z2K&@#RX^-SJH5)e*;2~ZaPevFvtYL?>PFpvCtuxp<2V1Y%6tMLewyHKrMc9C_w1_v@h_KPHHae_L z+L{Ko$zYotY_n$5!8T*q86IY5Al!;@fy1Uuge``(#bIsL)-15CQ8rSwnclMOY@}__ zUMk^PIS3!%Fd$-Nd?`O0xd^v`+@``jgbyM-R?7F~K7`w&A)nOqyWO!>yWZ-4uG^{%v)(&kAfbB5Y4hP$**+Q_L7R)XDwVRLGO zDuj3zJ_c^Tm z-Hg9Q)Po&1*kK1dqS*$pBN&!f!5cIpd>mnC1sxu5LO5zzM;+ENZEXfSX0T%pcE4t~ zg57_2gAi}fg782zjC6+R97%sAeRQsh8eBg9C*Q{1!hbcKA^U16MGn-GFYe^z4SC`8 XA|20nr$(l0X_Bn&;>hhV#kl?lHif44