Bug 66425: Avoid Exceptions found via oss-fuzz

We try to avoid throwing ClassCastExceptions,
but it was possible to trigger one here with a specially
crafted input-file

Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62795

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912796 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hssf/converter/TestExcelConverterSuite.java b/poi-scratchpad/src/test/java/org/apache/poi/hssf/converter/TestExcelConverterSuite.java
index 927d54e88ece69ad8a693c9d1d0d60a3ab674268..980e1298b83b83e3498c64a4d45e06e1ba583820 100644 (file)
--- a/poi-scratchpad/src/test/java/org/apache/poi/hssf/converter/TestExcelConverterSuite.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hssf/converter/TestExcelConverterSuite.java
@@ -38,15 +38,16 @@ import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 
-public class TestExcelConverterSuite
-{
+public class TestExcelConverterSuite {
     /**
      * YK: a quick hack to exclude failing documents from the suite.
      */
-    @SuppressWarnings("ArraysAsListWithZeroOrOneArgument")
     private static final List<String> failingFiles = Arrays.asList(
-            /* not failing, but requires more memory */
-            "ex45698-22488.xls" );
+            // not failing, but requires more memory
+            "ex45698-22488.xls",
+            // broken documents
+            "clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls"
+    );
 
     public static Stream<Arguments> files() {
         List<Arguments> files = new ArrayList<>();

diff --git a/poi/src/main/java/org/apache/poi/hssf/model/InternalWorkbook.java b/poi/src/main/java/org/apache/poi/hssf/model/InternalWorkbook.java
index acd3541cf7e240276348de1939727f88683740d8..a60fec9fd681ed81220c1092a3d8506ac173f935 100644 (file)
--- a/poi/src/main/java/org/apache/poi/hssf/model/InternalWorkbook.java
+++ b/poi/src/main/java/org/apache/poi/hssf/model/InternalWorkbook.java
@@ -466,7 +466,11 @@ public final class InternalWorkbook {
             "There are only " + numfonts + " font records, but you asked for index " + idx);
         }
 
-        return ( FontRecord ) records.get((records.getFontpos() - (numfonts - 1)) + index);
+        Record record = records.get((records.getFontpos() - (numfonts - 1)) + index);
+        if (!(record instanceof FontRecord)) {
+            throw new IllegalStateException("Did not have the expected record-type FontRecord: " + record.getClass());
+        }
+        return ( FontRecord ) record;
     }
 
     /**

diff --git a/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeFactory.java b/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeFactory.java
index fff9250a68afba1ff63813bbfa96c7319668c9cd..080938367b1b0fc9d89f8d221633ef55fe230d30 100644 (file)
--- a/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeFactory.java
+++ b/poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeFactory.java
@@ -51,7 +51,11 @@ public class HSSFShapeFactory {
     public static void createShapeTree(EscherContainerRecord container, EscherAggregate agg, HSSFShapeContainer out, DirectoryNode root) {
         if (container.getRecordId() == EscherContainerRecord.SPGR_CONTAINER) {
             ObjRecord obj = null;
-            EscherClientDataRecord clientData = ((EscherContainerRecord) container.getChild(0)).getChildById(EscherClientDataRecord.RECORD_ID);
+            EscherRecord child = container.getChild(0);
+            if (!(child instanceof EscherContainerRecord)) {
+                throw new IllegalArgumentException("Had unexpected type of child: " + child.getClass());
+            }
+            EscherClientDataRecord clientData = ((EscherContainerRecord) child).getChildById(EscherClientDataRecord.RECORD_ID);
             if (null != clientData) {
                 obj = (ObjRecord) agg.getShapeToObjMapping().get(clientData);
             }

diff --git a/poi/src/main/java/org/apache/poi/util/LittleEndianByteArrayInputStream.java b/poi/src/main/java/org/apache/poi/util/LittleEndianByteArrayInputStream.java
index e5c0b259a06d7cccd7baf17aa625c15e6e2db643..2f7215b0bb21a007a6173f79e4e4e5f99e5c6494 100644 (file)
--- a/poi/src/main/java/org/apache/poi/util/LittleEndianByteArrayInputStream.java
+++ b/poi/src/main/java/org/apache/poi/util/LittleEndianByteArrayInputStream.java
@@ -87,7 +87,7 @@ public class LittleEndianByteArrayInputStream extends ByteArrayInputStream imple
 
     public void setReadIndex(int pos) {
        if (pos < 0 || pos >= count) {
-            throw new IndexOutOfBoundsException();
+            throw new IndexOutOfBoundsException("Invalid position: " + pos + " with count " + count);
        }
        this.pos = pos;
     }

diff --git a/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffDrawingToXml.java b/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffDrawingToXml.java
index ea39f5147dedc9c2607783da90944355c34b7697..a87f34aad87b19b2b6c4b831407c3721355495b3 100644 (file)
--- a/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffDrawingToXml.java
+++ b/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffDrawingToXml.java
@@ -55,6 +55,7 @@ class TestBiffDrawingToXml extends BaseTestIteratingXLS {
         excludes.put("44958_1.xls", RecordInputStream.LeftoverDataException.class);
         excludes.put("protected_66115.xls", EncryptedDocumentException.class);
         excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5285517825277952.xls", IllegalArgumentException.class);
+        excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls", IllegalArgumentException.class);
         return excludes;
     }
 

diff --git a/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java b/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java
index 9a3bd3d64955f7432cd0d7c011b18dc88d713320..e21e359767174ceab2a704a166fea8b242ddd767 100644 (file)
--- a/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java
+++ b/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java
@@ -21,6 +21,7 @@ import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.ByteArrayInputStream;
@@ -163,6 +164,12 @@ class TestDrawingAggregate {
                 DrawingAggregateInfo info = DrawingAggregateInfo.get(sheet);
                 if(info != null) {
                     aggs.put(i, info);
+                    if (file.getName().equals("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls")) {
+                        assertThrows(IllegalArgumentException.class,
+                                sheet::getDrawingPatriarch);
+                        return;
+                    }
+
                     HSSFPatriarch p = sheet.getDrawingPatriarch();
 
                     // compare aggregate.serialize() with raw bytes from the record stream
@@ -172,7 +179,8 @@ class TestDrawingAggregate {
                     byte[] dgBytes2 = agg.serialize();
 
                     assertEquals(dgBytes1.length, dgBytes2.length, "different size of raw data ande aggregate.serialize()");
-                    assertArrayEquals(dgBytes1, dgBytes2, "raw drawing data (" + dgBytes1.length + " bytes) and aggregate.serialize() are different.");
+                    assertArrayEquals(dgBytes1, dgBytes2,
+                            "raw drawing data (" + dgBytes1.length + " bytes) and aggregate.serialize() are different.");
                 }
             }
 

diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls
new file mode 100644 (file)
index 0000000..d8c0114
Binary files /dev/null and b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls differ

diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls
index ce88487bdbf21ca5d361e6e6f78193a977874981..edc99459a8dd7b3dcd83516156044b99c3d60a02 100644 (file)
Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ