From 147c96da67494e88d6bbdc44c52287c698a94190 Mon Sep 17 00:00:00 2001
From: Dominik Stadler <centic@apache.org>
Date: Tue, 30 Jan 2024 21:01:46 +0000
Subject: [PATCH] Bug 66425: Avoid exceptions found via poi-fuzz

Prevent a few NullPointerException

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65450 and
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63907 and
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63727

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1915480 13f79535-47bb-0310-9956-ffa450edef68
---
 .../apache/poi/xslf/usermodel/XSLFGraphicFrame.java    |  3 +++
 .../java/org/apache/poi/hwpf/HWPFDocumentCore.java     |  5 ++++-
 .../poi/poifs/crypt/agile/AgileEncryptionVerifier.java | 10 ++++++++--
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFGraphicFrame.java b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFGraphicFrame.java
index 0738aba408..746afd001e 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFGraphicFrame.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFGraphicFrame.java
@@ -79,6 +79,9 @@ public class XSLFGraphicFrame extends XSLFShape implements GraphicalFrame<XSLFSh
         }
 
         CTPoint2D off = xfrm.getOff();
+        if (off == null) {
+            throw new IllegalArgumentException("Could not retrieve Off from the XML object");
+        }
         double x = Units.toPoints(POIXMLUnits.parseLength(off.xgetX()));
         double y = Units.toPoints(POIXMLUnits.parseLength(off.xgetY()));
         CTPositiveSize2D ext = xfrm.getExt();
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java b/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java
index 86f9956824..bf73030fe2 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java
@@ -88,7 +88,7 @@ public abstract class HWPFDocumentCore extends POIDocument {
      * Size of the not encrypted part of the FIB
      */
     protected static final int FIB_BASE_LEN = 68;
-    
+
     /**
      * [MS-DOC] 2.2.6.2/3 Office Binary Document ... Encryption:
      * "... The block number MUST be set to zero at the beginning of the stream and
@@ -283,6 +283,9 @@ public abstract class HWPFDocumentCore extends POIDocument {
         EncryptionMode em = fibBase.isFObfuscated() ? EncryptionMode.xor : null;
         EncryptionInfo ei = new EncryptionInfo(leis, em);
         Decryptor dec = ei.getDecryptor();
+        if (dec == null) {
+            throw new EncryptedDocumentException("Invalid encryption info, did not get a matching decryptor");
+        }
         dec.setChunkSize(RC4_REKEYING_INTERVAL);
         try {
             String pass = Biff8EncryptionKey.getCurrentUserPassword();
diff --git a/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java b/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java
index e65e679b35..add680a728 100644
--- a/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java
+++ b/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java
@@ -51,10 +51,16 @@ public class AgileEncryptionVerifier extends EncryptionVerifier {
         setCipherAlgorithm(keyData.getCipherAlgorithm());
         setKeySize(keyData.getKeyBits());
 
-        int blockSize = keyData.getBlockSize();
+        Integer blockSize = keyData.getBlockSize();
+        if (blockSize == null) {
+            throw new IllegalArgumentException("blockSize not set");
+        }
         setBlockSize(blockSize);
 
-        int hashSize = keyData.getHashSize();
+        Integer hashSize = keyData.getHashSize();
+        if (hashSize == null) {
+            throw new IllegalArgumentException("hashSize not set");
+        }
 
         HashAlgorithm ha = keyData.getHashAlgorithm();
         setHashAlgorithm(ha);
-- 
2.39.5