From 4d175324f2982b6b05fb7a5aea52831aeb2529e4 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Sat, 30 Dec 2023 19:39:24 +0000 Subject: [PATCH] Bug 66425: Avoid exceptions found via poi-fuzz Prevent ClassCastException Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63736 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1915003 13f79535-47bb-0310-9956-ffa450edef68 --- .../agile/AgileEncryptionInfoBuilder.java | 4 ++++ .../poi/hssf/dev/BaseTestIteratingXLS.java | 1 + ...nimized-POIHSSFFuzzer-6537773940867072.xls | Bin 0 -> 1782 bytes test-data/spreadsheet/stress.xls | Bin 62976 -> 63488 bytes 4 files changed, 5 insertions(+) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-6537773940867072.xls diff --git a/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionInfoBuilder.java b/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionInfoBuilder.java index 0674305b22..dabc789e8a 100644 --- a/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionInfoBuilder.java +++ b/poi/src/main/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionInfoBuilder.java @@ -36,6 +36,10 @@ public class AgileEncryptionInfoBuilder implements EncryptionInfoBuilder { @Override public void initialize(EncryptionInfo info, LittleEndianInput dis) throws IOException { + if (!(dis instanceof InputStream)) { + throw new IllegalArgumentException("Had unexpected type of input: " + (dis == null ? "" : dis.getClass())); + } + EncryptionDocument ed = parseDescriptor((InputStream)dis); info.setHeader(new AgileEncryptionHeader(ed)); info.setVerifier(new AgileEncryptionVerifier(ed)); diff --git a/poi/src/test/java/org/apache/poi/hssf/dev/BaseTestIteratingXLS.java b/poi/src/test/java/org/apache/poi/hssf/dev/BaseTestIteratingXLS.java index 6e18940a72..b239be7923 100644 --- a/poi/src/test/java/org/apache/poi/hssf/dev/BaseTestIteratingXLS.java +++ b/poi/src/test/java/org/apache/poi/hssf/dev/BaseTestIteratingXLS.java @@ -89,6 +89,7 @@ public abstract class BaseTestIteratingXLS { // fuzzed binaries excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-6322470200934400.xls", RuntimeException.class); excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-4819588401201152.xls", RuntimeException.class); + excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-6537773940867072.xls", RuntimeException.class); return excludes; } diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-6537773940867072.xls b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-6537773940867072.xls new file mode 100644 index 0000000000000000000000000000000000000000..646cf0d46a3af313e65d18914f5053de2eb30207 GIT binary patch literal 1782 zcmb_d%}x|S5Uyc=2SwQxQ1FMwF(K@3!V(h>k`M^;0&3)9vWW?a35g~fE?&sK0mvKd znG-i|?hy_~-hd_Cym$~IQDOM1w|k~{GCg~6Yw}H1f7M;v+f`G2{Jqd_?oXT!5=%3##p%?xiFVpVZiz0%%_12z&Ym_dB6p@ zHf{m8fg#`y3Azi75}*Q51nvPNz$h>V+y@>2cLYrjtSJpWn4{MG zmtW2F>o+e~-!8jz?sMgOp|6``zK-MzcM_Im*Xzbe$2nkQk=zvd*JwEZo}u^u_~X+U RcP}NfFjZ;j!tA(^j~i{9qWb^< literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index 4a146faa1f53de54d33e403d1daa69b1fe411a16..26af0e5ba373a84d40f5ee9c8aef40192148132b 100644 GIT binary patch delta 3051 zcmZvc3s6*57{|}qUDg#B?gF}NY`1L2oOHEVc`T^dVqjoGV6Gt|`KWeO1WNEhDk##! z%*@ZS6ph}Lsp;)$YGp4oN-a=iMjp^o zm&}z{%$s7uRxtWF7+bb4d8;{MDF!#YySsaT<m5&sIU}2*R(+9y*8c+IcYKA4-9f7#K-!4zSyL=n8XBMjBhNg z$-d*Z1w|!gr4fuxDlDGAXjts9qT>E*upH#JEHG;2n%6eEiFHzaE#65U_&@# zR(3a5#{67idglC}%%xQv-EOV;7dNg?aj`{Mdqx~b`uciCCLD#~h?}fPnsL;VTkx+j zx2O z;aiLz{XDLBW6boT-E+Lk6mdlDJ5H`2uXgaHW>Si1Ke%^Xb1|%L7|BbZuEE2ff(EQl zZ*KJPB`_LmDdaYK)H0f26%+I|=|^Q{`j(eMZKInngM*Fkq@~Cm#w!Ex)<)ykA~+lJ zF1DN;HpyWlhvSr+uYl2~`Wyo#N2qX=lOt4egp#8Y9nU~bKgS@+q2GEJTS*SP971*4)s{yfE!r1!SGg(vYoc$5!u@8LD^`^*0-vBC)Bli z_?ysxb86}OeRMs%ZDjB*%3^vl9395@J_e6Pe<*t&ORw1e+r)Y$)@xwL3icgh$5OAI zZL0DvWwDeUYg2>oQ5GjT;|xyxCy9^2`^3geY`lThUpW{1fY=1;mDR2)b(HxiD{ohW zA5xYmITH=eB;ovs*d&QfGO*(WyNlRy)axep|CqAzl#M#426t07L2^zoIFp5Q53$J- zn`~ew3U)8C6RFppbE@(QW%u`FTJyObrr%lOf@*ug!6M^(DY2Ob zHcPPI5SvB4E@S_1DSMc*=nggb9c9^)Guz@n}$`6!1 zLfJ9w|08A7CFgX5Ga#Hl5gU-$fPtMM*q@1=LA|mrs>)Hy9;K}Oq8j{#vRuiTYjDmK z&SS*Rl-QXDHczm>5}QZ8Zess>%4ShEs#6XAMp?e(%r`h^3+L~|&X(BO2DU)3$B8YV zUVA!KIg)dZ!8unr{~&g*#LhLa^91`RvGaQScd1GPW%GM7t+{K2 z32HB8?7y63w#PB%$C+$zb+rX@u0}!bRlDs_OV^ah@y#6WvJ8gGtAF$5P4S-)q6U?9{voR!w%2P`Mv+=_kS0b!E@E_ z8L=OTbyhHZMKHGKa7u$c^7`cD>QX(Yqb^YI>h#(o+r>x-^9AR*j^|*MYtexfX|72(0i_>sC4u{j^aKbS_jwj@`S&lg-hhjLM zghMeo6gV<_U3{d>6IsGzAPt+OR1h$`71Jy=Bu)r=4-NrW`pcM zuWGO3vZ`^}H|VL2KKd$M*8eM-{=m&Q-q=B8=TBv2nosaIWwB4?Z^>Gpsx;z!0nXcf zG0NLuv0xKEp}YeY2NrWdXzzl>PceG(-y_~~54UlTL&&iGaH(bSV@=}9trK14PN`*DLp`3P(wSP`+0!IHsh28H$s*dkNUB1?~E^n8k}hJ7D7 zKLc9~<{T1A6IcpZ@{rIz2U}w5Sz_r~YVatKy zfUO5>CiXK}4p=Ys`~sG1>dCeAHkgJ3mRgmwxn-_(nY$;pv`Hp>=|7GWBe-^pqGqUC5S9Wp(f9JX`D4WP5l#W2uzz^c-5~kXd8Va>H17 i@QG7*Ee_WDxSZ>_L3+l<>0kEl@oJm*U;V%FK>PoCGzn+` -- 2.39.5