From c4e8388742ab1e6818306df38aa0095742828f5d Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 17 Apr 2024 18:15:38 +0000 Subject: [PATCH] Bug 66425: Avoid exceptions found via poi-fuzz Prevent a NullPointerException Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66386 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1917069 13f79535-47bb-0310-9956-ffa450edef68 --- .../poi/xssf/usermodel/XSSFGraphicFrame.java | 5 +++-- ...imized-POIXSSFFuzzer-4828727001088000.xlsx | Bin 0 -> 10226 bytes test-data/spreadsheet/stress.xls | Bin 64512 -> 64512 bytes 3 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-4828727001088000.xlsx diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java index 0ede2c2c5f..18c69b616b 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFGraphicFrame.java @@ -63,9 +63,10 @@ public final class XSSFGraphicFrame extends XSSFShape { for (int i = 0; i < nodes.getLength(); i++) { final Node node = nodes.item(i); // if the frame references a chart, associate the chart with this instance - if (node.getNodeName().equals("c:chart")) { + Node namedItem = node.getAttributes().getNamedItem("r:id"); + if (node.getNodeName().equals("c:chart") && namedItem != null) { // this better succeed or the document is invalid - POIXMLDocumentPart relation = drawing.getRelationById(node.getAttributes().getNamedItem("r:id").getNodeValue()); + POIXMLDocumentPart relation = drawing.getRelationById(namedItem.getNodeValue()); // Do XWPF charts need similar treatment? if (relation instanceof XSSFChart) { ((XSSFChart) relation).setGraphicFrame(this); diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-4828727001088000.xlsx b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-4828727001088000.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..76b11055df8627916574db11c6e855f7c98d7776 GIT binary patch literal 10226 zcmeHNbySpF*C(aByFnO0Is~L!Qjta&x(1{hq&o%#rBS*&qy(g-K|(r}21)5}!24dg z+e4Ywl#@AZ}o2 zW_)WaVQgX!GIuby0kN~XSX;Hn&w!HHaDCGBcl1vlv1ghmP^Tw8lZ>cL3v8Ef#%vj(`hpS|J^LfMn(oItlKaOv} zu|xhHRR)Re0o4VrdO7IR&7R~;2DcKM+6m)H zZONEX5>~>vWweJxV~dC5*6cWPiy8&smz2kOjkuGsDTrAXydyKT8(bZe&=9tGT9-B* zxNk6Pn&djLt+Y9{d-PD1u$1i_f&1GxcXpkyFj!f%Hc~~SIcinjhBzV~03E&^O7V}p zW};c?VGReN6DtdV&kuzFmb0meV?Ef4pl>s%aI^>VghG9#ef2J4X}u&2RL17Lks1QK zs$y^ImY|1p4E|qi|0}V@XpzV{6vclk8KnK7RXmSh{t96wm~HZ1qx(I&<{tcVf~WQ~ z4b6-;XY$Utrz!>Nr58!t;(#rK#)zyk`o5!nr*i3)qxHslgz`5pXuA7Z6AoQkX}-+r zfB+WTTN*`d&8_N-<6g8gQ$3DkU1f<2+sN8TI9(Bc7?HWa;KT22xPA(-DgP_*IQ|B_=XS+Ry7=Sj<^OlVT5iSgkNhWscR8*<>%*Wpu226qHN)1_pLlJ}8m z4;L_NZ|s_joEYa@>>Wg{CUy`{3hWaGuOJkf<06M&bnjjG4!_K2tE4qm&k1M~fY<$c zx>2wPe=U$JC{y?{$Z^RaLiu-rklzx>Qv;xt@gK6d+21&zQMEqBB{obiUr&UdMs;oV4Uu3AJbgIB^Lx$rG~@Ju+~&po^0B|_BrMBQrnG9VAHZpgF0t&ZKw z9rXhPmp-nNG@}SUw-7Nowpfo45Pi1Sv?2g${_Qg?U#_|g24(vqW|@$w>LK6!0919h z<S!LfW-mC<=cG}GRcOJu9@u+H%hJ#e6iFlJx z_sI}Fzc;G04X9uwEB1KLE`3GSlf$edy8iG`2g@?pHRZ=9;hb0By?h(#Qh^CEQ3&pe zUDEOmGh&Jd+%C<;iLq%{W+BE7=Pc&NK}5oXT9K8+YV{N--9~3N-?tL|V)=)*6*ieB zYV39<&qV|T2Jx$UG6U(ZGISczdq3_sHRlPIJ2+oStK@XFI~#YR6p{P9n0A3T&8F)$ zbzWbmxYoX)96d!jMDuSEey4rLzia;%9)8)tA1G*npaAvWJi{)T+;(*m0+wctAGHgf zr_Z3V_6vD=?I3se4TToJ&fTjMvHY+65x{KBB15z+W)V!1ajk9c>EfJ2bcx4ZERm72 zZDLr7Zfd$_ALE=C^*wQk7IF<_x_4fMnxrGWb4cZ5NI}8L77WyL<#OJXwGIUqwB|q` zCNTCF1=@n-F~{3SgsV3mTCT448d56?E8e#;O+bGgLgN^}CD8pSFco}{Q5adcKC72O zboAA!TeBDRwM2|d*$C<(=au>`9&mq3#L&#Z&cXh{&BqN2Rx~ygr`T{IDiz09SnPxY zx%sK#K1B|YO$y|xzA9c)_InVs<+L_6P?O1M00<4`vM!1{wPU?(vfm^k zo?qhQU;l{pRVLGaE^2AVxuPwWPnCENSGDCkpPnIJT3RE&Bu%A{s&@}nYfM?oC}QMN zz}N{QQ~>^KQAb+4-aZ|ATE9t$6(JeAb8{^F~)EU z@-O32?YD|#9%t~t<-&KXnMX95388-KH1-OH>xl^A&yXld8T!;~LHdA>0-hu&oRTrF zt8$cxJy;4L1waOSwV7wx8sWC?$rBgm7}~jB!dB4d@9?PC7yWVE9ob5 zM&M+EgcLxglO3DO2?kmIOnkUi$>F>-nlWCR=DqErmRI{5YhzOc-bHAs?v^R%Sm$oW zQt>0rP#-ylX6{GxGDvd6L>ZqQne_#;T972V;O>_de~72Oe~9K7JxS4IG{BlsuPMd| zj6Z5)#|V;xAk`-LBPX(n!ZbL+rMO%9|dg~a?Q8`{l#g5p52b;FG_)!`8;LR+lf zB1Yy`B9y2QVlL8TAFiCX5Z07{ZPg+mjXAR_9A63BXThbuJ$Ai zSzrA4fjXJ-8f-p`SC`r2xb=$LkY4*#T$v9nwOQ^@zK8rsgsHmch zI(XRmh7r{H-Ms@N4;?)F(lW5p7Gq25oU`{KvS1+7EC0Mo1;%Gf(4X}=e^4%yiAJR< zsH_>+GQJn$5BxHxGQmw%GqzS}5I`aB(oBqr(;`nzebAvqp%cW83!9^sRnK9EE84+$WS2hDmpHoO~N<#$~g z^c|auSNHjR$MyX>rF5d(L1&dj+(iQoIn-P3dO77-p5bj;a?gYw&U2uyj#Q#8Q)Yu7 z<{|aVIz8(zSeM)rK}>Z2Ser(_xZVPr2)nd@sW9$e&5e94nnHTYN9B(XJcU0tnJ>&k zC{__tK8Nn`_T>zP3F3)os@-7xA|rMoh{ShEd^ppk+VpAkdDjeXCp4K-8*`nwTUSsS zyxL2M_Uu2oQ1p zdw%dQqU5+PO;X}?K~rp~ol2zwgl;xQ3@=8A%EB^4!=T%q=>v`myX}}IDDGv^_P=n7 z*R?tbD$kq|k0tOsA2|=9z0b0vUGz2uilL}mmLo)#7PTgeYa_Yg+@+z8CT71k?y)9~ zogHT6Gyz4tHPV;aBFa{eB@PFBRrfigxQBWuebXO#TJ1%O0%R*@z`b0IlNkNT5-DKSj$PrzTjcMp__cWIP0VvCLq0?|-AG#(&dF#Omj z=`@5Te$p@NP`G==P>H8M!`wzBt-%%VzS>kdBF12d(I}@B+rgvQi?`1_>DzERh9{qT z_zX^SoX3MT_Hw#{M)9I7yM|^(ZgFZ*{i$b}$C8)abMGC!!Vx{aEp)UJ!|w#w#xvSW z5P1wS9)0-V84t}J9RAEL{y^i63H^~+$X}<|_vUZX>)5e?V6H7Ge^3^=zDzcT6*;ZS z<`&v&t1n6dr|=c;<59uBUUJ;UD};xcmFT{sGinhuQB3 z!x^0y`A)hxfbaa->AZ2N^J7q@wgtZ=AFvWWc188u%?0sAPvEud`P;y*zv|Xvp{jfj zH^!2BS*AOu6so8=gZAZM$zPc!FisQ|mJTVonKvzcnFvlr9eAj70dp+^AZPLOa>xN` zf16MIfgfiZJ4<^rV`E58ar5!h6~*;|-m&2Zr0LH>yHb#1?>&KgI+AJrz99cZv%UlA zS!sk74!DLwJl9y?&%|__|9F4FPV(HtFu<8kRiy<7^N0OBR-~lV2|skRH<^j{JY$4Q zAaaW=%(leKZwJykD6T5}RFj-g#n{o7x>A@-$vA;=59C@S?6AR9*5oTh`Ks7)RSJbZ zVJ9AFL~lt25o3~DF>`R*jUL#xBaUMP)4~taH+?eCYck*DX=M-1QeMpTWY&=8Kw_ii zeLN{LrAHZu}WNP@HI^05J2$ z%l`RdI}+a$Odj%94PqozUou))>YXI1`PqcHXQ~j(tGJghWU_1bVkx2A13x2 zx^TzXesdub@NF{Wbz(k^yqGB46wvF8EZyM?Co5=Lvfk7ZkM~Q%T1bJQv9AcA3 zS5xgI6@IIF^7)HXjB6WmvM0g4gxF92e*>diHuMunzbxs$g3|sPyrqcQv zJcoicDszvq6PO3F5jF?-gtv02t zwpDF9j@lBsC0dQNyfq&EnXV6hYiplvKPl=vpEqG#_>q30h;B5kUMwP4r`)Qw=;fuW z)=W&-!)yS(inu7cez*7u&CbxK73@4U#$YvNguS&?-U`}%6GJP}vj^P7?a9K4ELBC& z&lDu(h6@f)1DWW#_^~-E{9ih<@Cj1y;F>x66Gr#Co>gNNU1a7hz~sR3nw2@ROFL4# zA|$tdFyL@-Hj(*G7m3SRU##nDw4v*P$T)4VhsSp2>mX&y(7`l8Xvr}rJOwy;BS^c( zF-OqWkaKLh9b~lcooS>HyG+7loKT?w3i~di+QYUWr3g^{inG@q$M2+wjP`)OJY}y< z_#7_8Q}lc>6{Z9@Rm(2YlN|V7wgG8%>#_6_u{Y&*N1MIlGp+&8MAqr!2GT`C|6lv>(i1-iyvbBMb8Tqg(4CnAu7th)90~&z%#YMSIQY+ zmi$V24~9^4rLru=Uwr?p0_NJ({VHe|q_C|gZc5#4oREJ3M{4C<@7L!A^aqKrn82wIaW z~1IfqVnfF?KLBwl@Cx`zD0+sZW8XDKRg6FJTuOTgDq1>s88=)F`yn)~nY!%f4r| zOu+D%Up5iCTYJdAHK8$n4zt7=#L4*~x~HI-2p+>fjLX#0?70ReCjPR)r$z4bL;EXN z=$Fy2173d(FI>RE+O^nU!!9uri z9u|)a^w|?ne}z%H(5QQfCD=5jicZd^D=vRUIjQsZp2!Mj&3H4hI&7=^H@ZhTizJI~ z9>hL=B9iPnQ}+0mvjt`Ma*5IFY)XX24+UKO=EyAS>b_{{deyYM!!~T_KJcjVJJxCt z#@?_p{X*6-w`khtV#-^;Rp>XK?w`HsDJAacrDNS@4 zyWa@2x|qM!?c>2D;}089|CKSDPDl?+5QOpZHQ8ZsMO@B?5Kh1Om6cAP2Rgm zRXL2k5O9f@JT|{VTO-GMh?50aht@*l!FWqM=?43J-FeEV<>+}a7Q+oZpvsd@7~DGL zAS6Y*jZD%C8&?;mjkRe;1ZM5}6<()TVw#$!`$y3{2X6Q%Pkc&bpFe2TCg#()p1_m9$BxaZ!u(lAa1Y5Tzz0txtwOjAMK#Rjy(Z~9tke);%u2L9a(it!`W_~L=EF{IR1RhPN(Aa^qA>f z0+d@F=2Nf|A(}MYiXkaTv#F0Msj7rdE4(%1`z`?y>!AUL+2qwp=(ykks^P4l{WaSw z)X;VnTSNNI1rnm8qkgt93zbFkdogQjmPfGkok@aJRsGVe-Lill$^EB;@Z^|u5vLg& zsSb8AA}2bslamC>uNF<)YlJ6Wa+4NeX)}_rjIC;)$W!enXU?~JII7|sP)xbn8-<7Q zN#iCP9<@<>2sRh^SU6s4#6AJHN9^~n1+KqHao%XSFr6XS_rCGY;ITf5#yOd>mf9L zl*u_Fs!Y{I{oOOge$zc=9mJC;C`%Dn!Og-8PdAJ_4yZ3!8@F~pdTDVMIGe;8epc$ zr+yWf!M5%w+>MX;5}D2^m2{T)@m!P(^ZZBpahf+QCaWdg-cH%k*e^D!>qryyK%J!Y zK)qTBiEl2EN%MInw_z{2YQ_|YK0JkwW~X73fMmc@4QR`35H_-`B3XF%tw&b&l+ym2 zM-*(iU4nyS`)6^?W7;aOVDazPeDWy>VEadh-0f?j=^NP2P8ySq=6x2s=EFTga^+Gc zuQx4ptEqPwb?Jo{JkOjP_IKr=723xsL;QjhR^&6~+6@jqJp$<#P=0Z#6A77^?1$zP z?{*%@DN26Aw{1+WM^|%BVRuDz)$>*Gn9gy{iZ-=TI+*W@`-0RaCp&WrfcEL@gk}v^ zMOsuu|Iku%?g`R0M#?m0;)Wo0F!Vod7Xa?F^JT-8N=x7QU{nGv zO=b*7u;s9xJtBDq#jZokE&LdpvB~oRBI+302pVRWvmJKROw%)t+z$^89K_zb%D@ax z8;PZ1?;V~zoQnS7n$1Zc5$Lbe661MVdB%R^!S$6?U$5RDcQ%1NE0Q4nby5;GmsfX$ zTJO?eYA%4Kv=u^*(LSukO9*m~J%tMR!Gk3?wEI&L&s?#8I4*!xqWCYX^ zE{@w|7$34rJZ>`ptsV6@MLxTtk)(=vE1XN`E*Q3^6^=p6jmCK%Q%t?4T!SG$qTAy< z(`cU434GQX@(vE$EZg>nNs}g~fpZdn5Nd$}3<-)yX^@rds{a8nPA`18fL_5p1l2Bs z%DpqW?KoL>RxbW6$K{&^o*5U+-LI3BZCG|Q)H~Fbb9SdUU9f@JhzoOwmNI|ax*`6l zrJuFJZC%||3yrZY77%|X(yV`_?_iT`q)YTp5d+|-SF;WK_$_UAh_zLb?xoi@vMe&y zCZ-bycrz!+zovet+Q8I7kBEgb1gM{D|Kz?d(htF=qSTkJ;P=rHL-*6gG3qxB&LSf+ zcRR*Ex#3ezqU45bqI`Q)QugW*2fkx&Tt^jHY?TRQ>;=Z#g{4c7(dp`LcFCA%+S))vv(m?(tx*;DfvZ3qBKq{euCHwd7tCS)zjeKs{rT&9bLj zx&Xg%<&=hrf$+JD;mw=Skc*Qnf&>xh)^7!h0uks>Y5q}fiK6@dF%>j9QnfV*&nRW5 zw?ZRNuNJ2g$uTcz-P%%(KuL%_+4ssWOmGEa92ign(!1>R&G6P*h@r=i8ib%wRJ2$a z%J1v9LpfG4KH%$q4H6Ts{eTVh^LZrYyeybYZc4;qXEu^eBi!>^%BD8fBJSP^>%j4J zGl{b2>%t)zk9R2gTkE?NN$)|*F4T@`Lmd=&&qHYCZP<`C=r3u7XM;PKGd>i6y#+NI zZ@hh`O$Oz4+v5Ijz5R8%sV!~;axextJb&tHYizH3jq*OV9#9)4=DF{sUwc)ktX*zC zlOnpgyA^=@!Y86JQiY8&zTvXTGWmc`-6B(Cz1=5hhUgwXeT8RHEQ_1!m=Q1zUDB7n zCV->haRUoELJf5WR5p|~n#rOMt;tA1_u_msHabsS2osz$1KkSVm`I+Z86jg)3Dxdk zNv59%8X#_IVOQ$w7#x=YW+Ex@VO=LS&qLb%Bk$OUIP=NR_~FLr_}|EoAE8!rB$b_u zPmkdWe?*NGQ;mAqpCQNp{!;eCeQwl&&2V-2R7ry#)fJ5ik0ytNcZuE}A74++e=RYXyO&pfg5uY0mOEEi zZqRa<{_O$f^$_~kdIACAf0+K~k@Q_!w?})|Bh6n+1=3i#L+ci^cLtny$=)6|T&IP< zmLWt75VC)p65ge7yT^Xr3H-J0Bi~T?#}UO{D*tJ=KKRM{f5sVq&NXgoVi7pH%BecYFTI)-mQ?DnA+f zMe85!=yq@6uWX$`W<>wM);~(?b`kzpwq_x&@UK*EvGuDfard0Ji;Zh%`fHs*ObJ5p zZY6)0!0oL3uf}HtIVOa_-zt>56mI8o*V%jZpFDUF{iN_`E`RsY+X=>XviEBRll&=; z|D=9@efa-=FX-3HAUjsFoA>>c`QMV5zrMOe`F3!-j@G}HH^j&MB=V0|blbiDRb3Vo a{}>6C<>4Vd0165R@&kl887ivlzy1f69^a|} literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index f32cb34e1611cd30c6dc4e7bf07c488a82604dec..98ce7f52d696d9a3b2170da68b9f893a409b4c8d 100644 GIT binary patch delta 2657 zcmZ9Odr(wW9LLXDSX^o40%laq9bhbjxn{eh!n!`d@>yt5ii%L^@Q0IP0TyN^YL*3N z_Uq}RvKN(^=Iw=*WiKOok*@@lLQ!WF#i<#b8pnR;@&!G2cjgD@bAG?ich9{SW~-k$<}EBOUnOG2{6<>uukntJ5~9Vn`ekQ%#v68NPE%j% z%o};*(9HDAjP#5^AQ;HZ3;+P#vzQlZ@|53dIGt|ECgt9RuUR|y}_ zDQzgB5qLesy#tG zK(Z-KK1f!RB`YbP>tb5T^EbqO^$S)qq95#>zqeRSrdgoo#s^4>1CMe!ZHmfw-i z9^Z4`dxXX`C(5N%(3}`r28T~`_%w%4bM$o_RkY19;3QB5G zpCjCo7+ML3Uvv01hk70_ou!}Sc$C&UjxFq11xJkLh|wG|n!|7$kI_ZPk$5;U^f(-` znj=$FZ6g9#&_mX2%n7#A}Xt%@MCT)MJ?-o}^aC@gLV}N;r}sYiQ~bORk|M zT%V#^u4`#8*Qeg|+AR4Zb#Z-( z1|H3j>#2b21|qH-so|(4H&GYYmucWJOTI!=xxPwExNfG}W0vt6j$=8;d7b_`W*TpR z4F>DiZpt^wYPaNDl;3U{wb;K2`|H}%jJLr8VD;^0_#LodH{;bV{s$4{OQmjf&tseJ zT%LE)n~wRE}IeWX77Ow1zUXF3~vP+rsWKC<)}ZQ1o1w4hhx5xo!h`Nz%DS` z4wea)cESvQ02b16Lav+wJCfQ{2~#<_CFJ2|`1J0A0Kr%mHaunAzJn0*B{5p3RRGrSvYQa9t3df+Cx zawa=DU!!+2=6AF68?f8JI+%S6c01TL9cK7DupBKX$CWe1$@w0=Q!syjhiU8qn+mpx z*$-fMfYozOJy@=mlk3XKb8>z}Zyx4T&X`66*qvZG%zgs93vBTjGyF5yG%aVED@T2K zNf5uFcRJ=9+4(D2KG+3jzk$sFOFL_Z8^LC3IWt{3>U%k17`c$w)RXXIj0s0%I`q9&;%pa}_)<@865QZty5B5jmK zMP{8cqAa2>N;C16Sr~m|Dq$HZ@gX>)fDIs04U99*bne|BgYWLnp5cA&InVFBvx|Si z>7Q^OsB~Xju~zUaLM$!YaR0-bA9$#wbcdKO{yj;x?rK-cG$A@oBWh8GqbJ%d$?gm{ z8}mb5+OW7GR0uZ@w#^r!$~;jt8al=Gb&9y)m9><4!H{oI3D-BNmg^pB;rbShaebQ- z`VFlPS1{}=yh8>3`kZ>OqyXbnGyfwc@wKcU*yK-aj(wGPslMNk?@=4O-pAaHaD@%b z);<7B2Fn=GwGY8=0^7)}0qkb5ngQMS5m-uq@yXgFC1{Vi_8uRjcP{2f*|`^N9@xx5 zUE2pXA1rH7_k9B9RdT#RIjMHee)OhdzK)%rf~A4AGCKga0BnMD8o_)@jxQ)D-Of3P z-gM08T+}ra>=v+cW}ksA1Z!aSIoPcMX0~74@Zj+SjUj= z`x0z%fbq%tA{GZNzQkVqEA%eGeDbiaHGwS!D`Iv8>^88fVcqvN*fJ$&Sx`=vozslo zEX?<@^Bb_+!Q3Od_AS_Qu+$OV_Z`@Z0OON&pA|tlEA5=`(Yq4!yV&^yST@)ZW!&T;gv z!TcyYPk`MCHgiK}ocy4i0z0P-y#<)BW9Lb*yTDqR{R*}YY=U!s z11nT=3WIWr?3`2REy8@xWnKFn>~64fX6<0bU=7Uv0J{gQ{qiR5G}!t{-A4~aGX<7LtjJ7iv&nCAQ+^CJvf -- 2.39.5