From f8a8189230d4a32ae0bb18a368da9c77d5e645b4 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Sat, 10 Jan 2026 10:02:17 +0100 Subject: [PATCH] Use the proper add-method to perform the check for max number of children If adding is done without check it can trigger OOM when fuzzing. This should fix https://issues.oss-fuzz.com/issues/391709145 --- .../apache/poi/ddf/UnknownEscherRecord.java | 2 +- ...nimized-POIHPBFFuzzer-4918886059278336.pub | Bin 0 -> 32832 bytes test-data/spreadsheet/stress.xls | Bin 75264 -> 75264 bytes 3 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 test-data/publisher/clusterfuzz-testcase-minimized-POIHPBFFuzzer-4918886059278336.pub diff --git a/poi/src/main/java/org/apache/poi/ddf/UnknownEscherRecord.java b/poi/src/main/java/org/apache/poi/ddf/UnknownEscherRecord.java index 67b6bc6317..98434aaace 100644 --- a/poi/src/main/java/org/apache/poi/ddf/UnknownEscherRecord.java +++ b/poi/src/main/java/org/apache/poi/ddf/UnknownEscherRecord.java @@ -103,7 +103,7 @@ public final class UnknownEscherRecord extends EscherRecord { bytesWritten += childBytesWritten; offset += childBytesWritten; bytesRemaining -= childBytesWritten; - getChildRecords().add( child ); + addChildRecord( child ); } return bytesWritten; } diff --git a/test-data/publisher/clusterfuzz-testcase-minimized-POIHPBFFuzzer-4918886059278336.pub b/test-data/publisher/clusterfuzz-testcase-minimized-POIHPBFFuzzer-4918886059278336.pub new file mode 100644 index 0000000000000000000000000000000000000000..c901951b19cfa125a2ea2a052a5b56f2199c73f8 GIT binary patch literal 32832 zcmeI5e{hx6na9t2Z|=>_F9<(`3n;vV@I#;h6%lBwfdGOaAW+m6DFFjXjUi2fqP0rZ zb{V#HtlQajXWU)4+dn$A(`mQUj^j8q({^^9Rd=o3cH1tyLtAH;-9KzXKl7rZe3NKTZ{B$x+OmMZgd zkO38-5>$cDff_IYOa!QanFJ<-DPStN1WW_dK^DvaGr=ryDYy*G26KQ9=7Kt)c!l}c z7l4Ie5x5*I21~$F@IKH0mVv9m72rysu*!?vR)TB5DzF-?0q+MN03QU`g6lvdSPRyH zCa@lC02{&eU=!F3ZU9@rR&XQO2DXD8;3lvW>;k*Nhrk|iGq?rZ3O)=z0``L2z&`L% zupcyo1K=RI9khT$;4o+fZQx_z4$uzn1RdZA=mZ}JU7#EEfTL8=ySU#CRG04o_kvG= z`@ko`{ony`9PEVC5kmUpyn}m}4FRDd${L>5+u#-Tv)2{#o3Hi+=-B zKZvHaSS=b^-10qv_*LR+D^hYOV8Zx2Q)yfNaWC=sccBB)?~$0PCSmih_DOOm5cctW zHxGyNYS=IyHU9{)b_Sa0TuZ-B4&tvS$Pn=lVx~4rZG_AoS|7DRqcxe4=zmZT;&G|g z-$m)SBZW@e`oyXEc9rr#L;j;aq161Vtq!>)X<^mwNdG!$4M$oJDgUDNKa4AWS9!^( z^j-YAj=Tj@{*`ZMV5rWhh*8|HEOnmZ`oG?mLo+RK=`~^YfcSHA9WDuR`OB{QtF}w+ zx9YIk5w&S5ZB>)7|5v(efST^H?*He(vmVR`3&29K2wV<^>i?HRQ(aOXt_tqz|MffU z|7E|pOfsf#Z$4+S5j~P~I$$j&UeJTS*R0=kpUNwVl1PuFE7B>owbCQ$Sg2>XC-!c* zjelz%G3G&Ymg__I`mnuzO1*04A$$D}OlnQ9W%XU_@^7}!>Gv}5_7cRGc{nK!pSIV} z*z2Fz>))BWUu)dgD8^Broa0ckn)EfTT*1(f5$iCU{HE`%S;sX!v^*@;d3&_DKf> z<>wjh>pYiF$wvA4A^F*cb*TJ=Wv*O3N4n@;xxO8xt<Ajmr74XhX9gZRo{NB$E^&8Dy!k^YANM5&#U`& zJMnzZG|uqM16BhE>)`_=HDiuj&2+W*JJzMwy0|*rZ(ZUw`8q_GG4cA`pH3hFmGh;< zDR{pB!jJnC{)>yA=}-ENYwJy!|MfrqQ~ybCQcf3I=Odw$UQN!$mljCYD`K)!b2LzP zY7^cAvU}zQWat0)e95l&fAVCvV36!270K?ZnCy~+WG9CUNOoSi?J34i?|NT*3BBw5 zmh|rI3(~tCyZ<#$c8dqePEwKVE`{<~P-n{m*@ZpDaa##Kg-`XbG7s77!}j_BA(!X% z6vf-uB=vMZ;Rn~vEvkb9>gJzXmw4TL&bq|wW|f+?;&t=Ne@8}r8-9w6%oiphqt9;p zWuA*TNaWGy zeuYH#UpX6z)IR%qo6ILz_yK9myS$?DlUt zgY0%3tueIg56+eBez-7CcFPCJPEsk|c+A$4j5IXP%U`>i37eaawzapfUg_`ZIns5H ze|^`Hqn&emzo9^( z+%?~r)7-0VUgh^O;APK!HPI@6Nk2=-GJ8$=mtZfq*NiV-6}_5uHL>=-m$mRV)>v+5 zrR8o`SoX3`-eOnW_OjxnHP02SJ+I)e!LI*x60Y(o#a{K4jX&#|8b3XiRQq2di4(28 z*4lSYY_qFZ1S!ePL=Mul(3BEL`rH`E#bcGQoz#!kR0gYsBZkN%ZsGMS26&s6&w>X;L=xp>(t4I?M@5t+jDtBTN93`fs+*{g@6 z6aUI0^lOUHR~4bJE<#^Zg#P{_^bZuFf3OIhlNiIw|GFXRc4Z^m7|>nWR%NRF6y<78 zs9*E4Ya`pbsKlEJaCBjuMywx_t`VD;-7p}=Fg{1y7^5Z8G{;x%iw5y zUo2dH{yrL`4#jBs zDLgz3t+gP{Nw_Vd4V2W!BKN^sa>p>V_82W+!gm&=ISDX|3N)SZ+zBVy&cJ`ZWF7V6 zF>Z0)chs(Y>T;_iEsolqPaRN`dt%g_oL$JH0WCjGPMUW`AqPtH?#O+xG>;8KyJr~M zy~EHxF%0d#VQ8N$NOL*AKcKms=QP;W^amnpZWIu29goL2M|$02X81Z>;IpxRJAW;} zXV|O*7jnH5n+DRpJpgcwt8b@@esCbAg(F|09pS2}VmI#MrQLLERv1tVvy@VDNk&q?KOYnN1t%d(IJLKzNBS3EZ5K9rXvuhLT*+iV$1DjlTjZth)B?zA#2 zBppd#C8OzcnA0#GpHmZ}>j;YYw2{}=vL4)aKv8VDkP3eYmqN54q@}KdTMvIqlh4t; zFw{Wzoh~jLBBvcXjuL94a_Gt>m)aikdxR9s8>CUvw|01Ta9~gAmaNv=(sPHbd~&oM zjjG`wVW|5Z)+Wh0t#)zOkmkh$_=vZ3LK29F4^u0tTP^s#bgPwPBs$R36{V+}P+E9t zwmfp_tl_|;QtaX%9InPL;7C)PE^8s@AThYy<)m^2{OzVGgOJbutTaB3- z*gSJdV4Gm31-6N1dSI(H*}yi*%!sHn1KVUXJFrbLa{}8`GdHkZV(J3hG&3)-O*i#{ zEo&AAwi#woV4G={1~v}PSV^xxsS>j%aLuNey`OzlmCW+VDGF&3wggbAatLx`{%-!7?NQ)zbbpWWIrye_x6K|6uBJ}B`Zu38+kaQv`jyYK+_~_Z zKUMv0wu_G`j@;g3^|RR?IG#!^YUj6FUDqzE4N^PRWcviQM0eoQ!XmyV-5cl)IxXc+ z;!{1^3GFbh;?iZqt>w^_7Ed#@ugy?8h@*vTtKA@;XzObSVO*LOw{oDmq_$AYsi|21 z;Mw0?WLRb+9cyM_T?kf!bwJCs5~n8j{p^y9z6sn6G~6(Cy$IQ>6R(85&QyiLY$DiK z!Ph_|E4p`qQ$SmQ+TvLUxMILPHQfsUp zFIRxc={t-1rw%BrmcSB~$;#@w%Y?nfEEDz?v!Xs? zmI?caSy8Jv%Un~rs&ciB<=(N6^W4k*{ZV?umN*`#lbTv&CmFRz&gLj;i}UO0lR;g5 zgp)$T7YOqvjGFZknRa|v*PXxbtu2>THU>`k4TwvcR$LEek3tVt+xYUec*oWz-}RT$ z%C5ZB6i>-$G%}tN?E+BTwiTfI+mV%iYr9$n=hF7-CsNdy9_x!nATnyv3$9C#hn zlYp&YKe!+8sDgP0{4X%XRSzaIvd+ygw$T%7hM|X5+zbO5B+BWr@1X}jL@%tKT6s#- zPpfY}%(dMfUQRRC(7Zq!kj+*?Dfl$=cNeZxZJ1s3@?Cbu*k&JKD(7(@g;ywXQg57M zJl>2{Te)h}wcK2fO|#5q($r?hLMc+Mk%PjhH+Oux@YBY4q}h%Vs?1vJL!%*$xqZeq z%AJ;gDj0icGox?iUtq|hB0v;dT@cDGYKeX)gX=Nzoi-$N=`{FpEcPZC!;Yic*7Sjlhk$6=TO^F*ws+tGI za3$B9aXVm?Pz}+w=&;ddP|E=t{&!m;bZ~FMcWrMY*IV&%6d|}}C@tr7!BG{e4ZDW? zck@e20$R2@2;BLD+X*|RS1V;3ncnZDVy&l|?*;34<@jq1BN1BG$7j+${{Km2-Y1om6G8Q zas&R&zL}gKd>Okrag0ln=B2E+9$T@&K+0E3m-cm_rQA=RX7QrdJI$Wi>8efr z_nNb7kD1=^#1k{^MoqYDj;kR}B+|)LSt^k%o8a5gz=_*&CFZGRy+lt9R((?^t5#`n zEQwewO~eu$)X>ukjj>p&(q##mAeLhY%=52AMHBuNT$7I;D!2P$$7s^V>~GPSaT>cc z4aq6m-Mj3zA^p6Y@-v#Wp3s6?BD>y{JynbHrE3$lnM_rd;ilbVOk}&D`~*tMp1^Z- zq!m!Rp`IC%x)JKxd}W;)`)jDlW}K!Tp9m3j~3^wa=4lqO{#Uei+4txsDKQdtzRkyQuZ` z3vzMS=TrAEG>B3bP@PQL3HupK4RoqLh*^mlH!%q`F<;rn_-cc_GN~J(8TkBrX(xIq z821twZUav=qoBt{%o#eKVU13d63R}4?FedE-;Q_%w|&lqN2iikrYx4fb&Xx%{?p zTEfJaEW01aj99|p$+y!+F*R~U9sLT|5_OCvJnS>z_*LP$aN)a_@M^jXKNB{EL63 z@@l$9$}%+JtI@_^P3K+>7|KO=?IyaNsjj$l$@X`_tLX;iMP1y^CH==cB%JK^@TUp)eo&0-){p zMc{I<7%TzWS$-eTUg0vZ9H<&-4_RTy-zsb0D$8-1Vc#l?q{i5|!9B4CMpKuO7?xzl zUrk4cGX82hv?h3!-@E_SbQQ0=$-U=mtRTFJSJT<*bm706ZUx!A&|Xc)yIB$qPt?v@ z61<#6XRVIwL{so;r=eeABtIj0h0*w{=}d;lQS8}^QOfSU@M^j-*Sqmo)0y}1tLf}w zcxLz)mwPqd_^avcP}h!E$6rksh(RMF)2Jx`=AC#o zSU2&qhi6T0wbFgkC2%hJrqxQ$SQ#H^Az{dXx$hOs!;e;I*be0Mf*m082#uQ_X$|#r zpay9BROd6;wtPpwS2Vt|RPcL6#a5Q0?-gkwTaSRf-QO$HtgcZ?gem&HB5k}6V@mv9 z(W>$96+Q12`d-p|byH}Xlpiw|&8(VNvD4i$EppLH`0$%Tzb}c8qTve;HeSUoQz+_a zQ?%so6$O1@A!d1QI-YCr| zH-${>uWoiJDfWwd<44W5yiik+apeC22*{-=L zwj9X&AakM2VC*q!v_cOpIJ_6yXs_e@D6zgxvWQ%l`c=8H=y~4?9^*%R$B+2F-K#lk zs5iw|b6VdmA1os`gG`A{^fe6HXiR1SO+_x_J{#yESmSeG#$h%#sZ literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index 94775397c807109f488e3906f78a049c29f60380..4b0be32353643f018c5b301cbc340c5f63857bd8 100644 GIT binary patch delta 2569 zcmZ9Mdr*{B7>CbU_RcOJ_k~4lsi_GC5DbZ78f6%RnWmX8 zGdsg+oT*{_%W9@cx4=-T%&sD37c;ZcZkiPlMG-;tp6~ksb9Q%zm-pHCJiqtsE_4l> zyN1m#?{|5gZ)EgvvNav`jl0@*v^4MTVbN?Vc*ymHWv`7fZ>ZQ^RLIYTddh2(f);;Z zbwRe@@6XFxQIM1G&&|zSw(H@#bjFHno10tOe6 z;A?HHZ)t7V9lF$LvG66q%MV;dw!1X6jPsI}1x>hk5AabS96g<0PPE>p1ptKCZ;!rFO#o|yb zPTlglh_dRtETK~H1}u?^B~r0ODi)V+c~f*6mi^Ll0v5MoaVr+LVu{i%Z;4UE;L+U{Ro%^I7S)TWx#B}MbQMW0OkOe5)AwVm}@}l! zQa$QF%$7p%w6x9w-UfI~LOQPhGc5zWBBMCqdL?RoSkwkR%7obs5EOdI8Ua`i*d(DD z@OHpw2nH;G8PTo67UYdVF_J;cLGkzC^z61C2C7pRJ9%zh1qHdDw4^n0p10;N5W{py8#ap48#C# zRid_rMb+q0v6!tfW_!IPjRU&}(hLdX0k;8GOPBz7FJQNq@6-|j?}IXh20dW4b4m%5 z0PE(I5+(!I8*rdIh4=CP#k?TGmBUyeE#2jI%-BR_8jlmzY20P6dGc_Nw(kNDrkUdh Sy3%+DH+d2Urmp4Ii2nhHW#+vA delta 2534 zcmZ9MYfzL`9LCRC-o3KB?=Fi#urdRgjRQlZ#qBLb$xE6FSV)WE0wXhxSEH@j-4UF_x(2K7H@A1>!*Km7On_Bp@joMm_W z#*Dr(W9TV={*~Jq{rT9c-tO&p-+TLAciyvyg;;U_0skY;UN>U}iN?T+2Hug_vtesN zqP@rI#Jx!371JnG4;nIkB3iO!wRKi0o!swVO5R2dJ(xj~S#IHzYu;^cG> z52xpyz$p!fTljuHVDQwigPRU<-rzp-0B3B9-UPWhpB)s2lP}>3QQ_oe{E&#raacSg z$FMjkM^c=U;|1Y!@uJ!zw0(rOyXc06^e~i+&P%cvp>`{E6){=lruQbF9T6S0oxddR zn{V-G7O%1#g~h8`ys(T*%gf^2e2Y)BWGl-EEZLeR8ha+LYgJ4EN{XR)+}LI9+j52#Nd2O zj%JA{%iFL-G)n}QX=!;!6nc3ze^<14>Hq$o*e%DX7?k6Eaa@iu;qcM;KveiBIWBtS z_)t6};W05P$4BC#93Ll3v-xul{)re5(DG9;DaU7GagcT#7aek(5Cd|2F2;lO+81I{ zjxWVxlg3HWB1cN>mg6fiNW(gXOO&Zgd`+tn`cjtBCFDnP=0jPoF8mF$<(aGqh4@1L zt*8i*?mH2qVSbOuRfs$h;!DgQ04o8jl8;08>3Cf^2z!y;99^tB%A`g5%5WZ)->Qct!kaEYQ3uZ583q)T#!~us^99H z0HXy2Ip7AswFE5(;6|-#qpfO_s>(uk69jvu)c|Y)9Fx!q*bF!!t6YFBT2+g!YO|_x zBfA-brpw6c0lXP-mxNxxTLAYFw0wZAT2-s9YKyAMMs`akJ5WecKUf>2KUM?yZ@?-s#hJU!2*Jk-E8Ec?$ s-*DF%w`eZm5z$t{{hre&axe8hnBx5